Disable emailing of specific alarm ISE 3.2

[eglinsky2012]

In Settings > Alarm Settings > Alarm Notification, I have my email address specified as a recipient for alarm notifications. From what I understand, this sends all enabled alarms to my email address. At the individual alarm level, I can override the default alarm notification email and send alarms to a different set of emails. However, there's one specific alarm, RADIUS authentication request dropped, that I want to disable email for. I want ISE to continue logging the alarm internally and for it to go to syslog, just stop the emailing. The failure reasons are mostly "5440 Endpoint abandoned EAP session and started new" and issues with credentials.

I did a search and found that the only way to stop receiving emails for a specific alarm is to override that alarm's email address to a dummy address. But that was for ISE 2.x. This seems like poor practice, unnecessarily burdening my email system to send and discard several emails per minute. Is there a better way? Or is Cisco really still ignoring this issue?

[ahollifield]

A better way, IMHO would be to send the logs to syslog instead.  And have that syslog system take on the necessary alarm/notification tasks.

[eglinsky2012]

Thanks for the suggestion. We use Splunk for collecting syslogs, and I'm not aware if Splunk can be used for sending emails based on certain logs that come in.

[Aref Alsouqi]

I don’t have an ISE instance at the moment to poke around, but how about creating a rule in the recipient email account to filter out those unwanted emails and send them to bin?

[hslai]

@eglinsky2012 It seems Splunk can. See Splunk Answers / Using Splunk / Reporting / Step by Step to receive email alerts on Splunk 

[eglinsky2012]

TAC has opened an enhancement request: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwi96213

In the meantime, I have disabled the alarm entirely. Those errors are still getting logged in the client authentication logs as they occur, so I do still have that information for troubleshooting specific issues if needed.