cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

883
Views
0
Helpful
2
Replies
Highlighted
Beginner

IPS Alerting to multiple locations

Will adding multiple alerting destinations have a dramatic CPU impact

over a single destination when under significant alerting load?

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Rising star

Re: IPS Alerting to multiple locations

If your sensor is not overloaded today, it's doubtfull that adding an additional SDEE feed will push it over the edge. But if you're already showing a missed packet percentage in your logs, then adding another event feed won't do your sensor any favors.

- Bob

View solution in original post

2 REPLIES 2
Highlighted
Rising star

Re: IPS Alerting to multiple locations

If your sensor is not overloaded today, it's doubtfull that adding an additional SDEE feed will push it over the edge. But if you're already showing a missed packet percentage in your logs, then adding another event feed won't do your sensor any favors.

- Bob

View solution in original post

Highlighted
Cisco Employee

Re: IPS Alerting to multiple locations

In addition to Bob's points, please be aware that Cisco's IPS sensors have a limit to five (5) open SDEE subscriptions; this equates to five (5) "alerting destinations". If you configure more than five (5) you may encounter subscription contention and inconsistent events being logged at each destination.

Scott