ACS 5.8.x: Is it possible to filter reporting/remote syslog for a particular TACACS user?

[Nadav]

Hi everyone,

We're using the APIC-EM in our environment and that involves ssh connections to all our devices every 30 minutes. The configuration related traps/events strains certain monitoring systems of ours, including Cisco ACS remote syslog servers.

Is it possible to filter the APIC-EM user from being stored under ACS View, and/or not to send these events to a remote syslog server? 

Thanks!

[Kanwaljeet Singh · Accepted solution]

Hi Nadav,

I do see such an option in ACS. However the opposite of what you want is available.

If you navigate to below "Menu", you would see that you can define "user" for which there ACSVIEW would not collect any logs and send it to syslog only.

Monitoring Configuration >

System Configuration >

Collection Filters

Regards,

Kanwal

Note: Please mark answers if they are helpful.

[Nadav]

Sounds good, thanks. Is there any way to ensure that those specific syslogs don't get sent from the ACS to the remote syslog server?

[Kanwaljeet Singh]

Hi Nadav, Unfortunately, i do not see a way to stop ACS from sending the syslog for specific user but i will inquire and see if there's something that we can do about it. Regards, Kanwal Note: Please mark answers if they are helpful.