cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
751
Views
1
Helpful
2
Replies

How to filter ISE alarm?

ryan14
Level 1
Level 1

How do I filter ISE alarms to NOT include this type of alarm? I still want to see when config changes, just not configuration added by internal-feed-user for OUI. I see the filter in the alarm settings but not sure what to put in the filter.

Alarm Name :
Configuration Changed

Details :
Configuration Added: Admin=internal-feed-user; Object Type=OUI; Object Name=98:39:C0

2 Replies 2

poongarg
Cisco Employee
Cisco Employee

Filter parameters in the alarm setting is to define the data to be evaluated. The Object Type, Object Name and Admin Name fields are displayed for Configuration Change alarms. You can add multiple instances of same alarm with different criteria. 

These parameters you can find in the alarm above. So if you define these parameters: Admin=internal-feed-user; Object Type=OUI; Object Name=98:39:C0, then only alarm will only generate when this criteria will be met. So exactly you cannot filter a specific alarm.

 

JeffL123
Level 1
Level 1

I'm having the same issue as well; it would be nice if the alarm filter settings accepted regex statements or attributes like not equals or !. Were you able to find a solution?