02-28-2008 04:16 AM - edited 03-11-2019 05:10 AM
Hello,
As I monitored the CS-MARS incidents, I noticed that the System Rule: Modify Network Config constantly firing but we haven't done any changes in the device. The reporting device is ASA firewall which sends syslog messages to CS-MARS.
Below is the raw message sent by the ASA Firewall.
Raw Message: <165>%ASA-5-111008: User `fubu` executed the `terminal pager lines 0` command.
My question is why the ASA device sends a syslog message to MARS that the "user fubu executed terminal pager line 0" but we did not execute this command? Is this a bug on ASA device? Can anyone share your knowledge or give some thoughts regarding this issue. Your help is much appreciated.
Thanks,
Carlou
02-28-2008 06:30 AM
some monitoring devices (including mars i believe) will execute that command so when the device views/copies the running config, there are no issues with having to send the space bar sequence.
its extremely annoying, but it's not a bug. i wish those devices were smart enough to return the pager lines to the previous setting.
02-28-2008 06:56 AM
So meaning the MARS itself will view/copies the
running config of the ASA device? Is this a normal behavior of MARS?
Thanks,
Carlou
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide