cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
351
Views
0
Helpful
1
Replies

Cisco security network analytics change core events

dijix1990
VIP
VIP

Hi, I need an advice. I want to be allarmed when one host eirher consume bandwith above 30 Mbps, I made  new policy in the "Core events" - single host policy but it seems doesn't work

dijix1990_0-1696586186312.png

 

What am I doing wrong?

1 Reply 1

jamegill
Cisco Employee
Cisco Employee

Hi @dijix1990 - the key thing here is that bandwidth consumption is always an average over some time-period.   So in the High Traffic alarm you're looking at the average over a 5-minute processing period.  It will not alarm if the host simply hits that peak.  Does that help?