Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
Milan,I tested sigID 2100 in our lab using "unique 10" also. However, I was unable to replicate your results. It seems that 2100 is performing properly here:evAlert: eventId=1076141258673960123 severity=low originator: hostId: qsensor-57 app...
See if the filters have indeed been applied to the sensor by first ssh'ing to the sensor CLI and then:qsensor-63# conf tqsensor-63(config)# service alqsensor-63(config)# service alarm-channel-configuration virtualAlarmqsensor-63(config-acc)# tuneqsen...
Either the device being monitored (eg., switch) or 4210 may be oversubscribed. If you have a TAC case open we would be interested in logging into your sensor if that is all possible.
