Excessive Failed TACACS AuthC Alarm Settings Fields

[scamarda]

What do the following fields represent in the alarm settings alarm configuration tab for Excessive Failed TACACS Authentication Attempts.  I'm thinking they are filters. If so, can I have multiple line entries with comma separation?  And is this alarm for NAD - ISE errors or can this be used for tracking failed user attempts?

[hslai · Accepted solution]

Excessive Failed TACACS Authentication alarm is generated when service node are experiencing FAILED TACACS Authentication more than the mentioned value in Occurrences greater than field.

The fields mentioned under that alarm are the filters, on the basis of you can specify condition that when this alarm should generate. Comma separated values are not supported for that fields.

In case if you need to monitor with two NADs and three users than you need to create separate alarms under Alarm setting and specify the Alarm Type as Excessive Failed TACACS Authentication Attempts with specific filters like (users or Network Device name).

...

Occurrences of T+ Authentications are counted per PSN.

Info provided by our engineering team.