IPS Alerting to multiple locations

[cwmontgo]

Will adding multiple alerting destinations have a dramatic CPU impact

over a single destination when under significant alerting load?

[rhermes · Accepted solution]

If your sensor is not overloaded today, it's doubtfull that adding an additional SDEE feed will push it over the edge. But if you're already showing a missed packet percentage in your logs, then adding another event feed won't do your sensor any favors.

- Bob

[Scott Fringer]

In addition to Bob's points, please be aware that Cisco's IPS sensors have a limit to five (5) open SDEE subscriptions; this equates to five (5) "alerting destinations". If you configure more than five (5) you may encounter subscription contention and inconsistent events being logged at each destination.

Scott