Showing results for 
Search instead for 
Did you mean: 

Change/stop alerts that ciscoworks sends out

Level 1
Level 1


Im trying to find were in ciscoworks, i can adjust the sev levels of various devices.

For eg - i get this alert

Syslog message generated from device au-aapvpnxxx: Apr 28 10:48:01 10.x.x.x 73090715: 2010 Apr 28 12:56:10.310 +0900 +11:00 %HARDWAREMON-2-10: RPT=227329: Chassis intrusion alarm is inactive.

It comes up as sev 1-3.

I dont want this alerting, cause its only a chassis intrusion alarm.

What would be the best thing to do, stop this alert from emailing. ? ( were do you go to change this / stop it etc..)

Help appreciated.

8 Replies 8

Level 1
Level 1

Im running LMS 3.2

Joe Clarke
Cisco Employee
Cisco Employee

Go to RME > Tools > Syslog > Message Filters, and create a new filter to drop this message (i.e. make sure the filter mode is set to DROP):


Sub-facility : *

Severity : 2

Mnemonic : 10

Description : *Chassis intrusion alarm is inactive*

This will keep the message from being logged to the RME database as well as preventing an automated action email from going out.

Thanks Joe, ive set the filter in msg filters.

1. Just some clarification, in the message filters section, were all other alerts are listed, is this the list for all alerting on all devices right ?

2. That code  for facility > HARDWAREMON <, what does that mean ? ( vpn gateway code ?)  is there a url where lists what all codes are for devices ?

3. Also other ciscoworks alerts, to change their severity from 1-3 to 4-5 is it just a matter of changing the sev number to like 3 or something.

Sorry for all the q's, but your help is appreciated.

Joe, looks like im still getting the alerts emailed out.
28/04/2010 12:02 PM

CiscoWorks Alert - Severity 1-3

Syslog message generated from device au-aapvpnxx: Apr 28 12:01:26 x.x.x.x 73112433: 2010 Apr 28 14:09:36.640 +0900 +11:00 %HARDWAREMON-2-10: RPT=227353: Chassis intrusion alarm is active.

Any ideas ?

Post the full email being generated as well as the syslog.log which contains the raw message received by the device.

this is the full email alert we get -

Syslog message generated from device au-aapvpn000: Apr 28 15:31:28 x.x.x.x 73162144: 2010 Apr 28 17:39:16.740 +0900 +11:00 %HARDWAREMON-2-10: RPT=227403: Chassis intrusion alarm is inactive

Post the NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/filters.dat file.

1. Typically filters apply to all devices.  However, you can have a filter only apply to a subset of devices.  This is done from the first configuration screen when you define or edit a filter.

2. The HARDWAREMON is the syslog facility.  Typically, all syslogs generated by a given device and software release are documented in the System and Error Messages Guide for that version of code.  You can search on for the appropriate guide for your device and version of code.

3. RME cannot modify the severity of syslog messages.  They are assigned by the device.  IOS devices which have Embedded Syslog Manager support can manipulate messages on the fly to change severity.