Filter/drop bogus identity requests

[mykys]

Hi all,

Weird one. Our system receives a lot of requests from bogus identities (looks like broken script):

While we are investigating this, is there an easy way to create a filter or something to drop silently requests from those usernames? 

It generates ~3M of failure requests a day and floods our live logs.

Thanks,

Myky

[Rob Ingram]

Hi @mykys 

Perhaps try using a collection filter to match the identity being sent

Naviagate to Adminstration > System > Logging > Collection Filter

[mykys]

Hey @Rob Ingram 

Thanks. 

Was not aware of that functionality. 

I need to check the admin guide. What is does (high-level overview)? 

Thanks,

Myky

[Rob Ingram]

It would filter the identity/username specified from the logs.

[mykys]

Will the request still be processed by ISE (CPU hit)? 

[Rob Ingram · Accepted solution]

Yes, it's just supressing the log entry afaik.

Best off finding the source and disabling the script.

[mykys]

Cool, thanks @Rob Ingram