cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1585
Views
0
Helpful
2
Replies

IPS Alerting to multiple locations

cwmontgo
Level 1
Level 1

Will adding multiple alerting destinations have a dramatic CPU impact

over a single destination when under significant alerting load?

1 Accepted Solution

Accepted Solutions

rhermes
Level 7
Level 7

If your sensor is not overloaded today, it's doubtfull that adding an additional SDEE feed will push it over the edge. But if you're already showing a missed packet percentage in your logs, then adding another event feed won't do your sensor any favors.

- Bob

View solution in original post

2 Replies 2

rhermes
Level 7
Level 7

If your sensor is not overloaded today, it's doubtfull that adding an additional SDEE feed will push it over the edge. But if you're already showing a missed packet percentage in your logs, then adding another event feed won't do your sensor any favors.

- Bob

Scott Fringer
Cisco Employee
Cisco Employee

In addition to Bob's points, please be aware that Cisco's IPS sensors have a limit to five (5) open SDEE subscriptions; this equates to five (5) "alerting destinations". If you configure more than five (5) you may encounter subscription contention and inconsistent events being logged at each destination.

Scott

Review Cisco Networking for a $25 gift card