Case 483354
We have port security set on our cisco switches in ‘restrict’ mode which doesn’t shutdown the port, it just blocks the new ‘mac’ from connecting. This causes continuous logging of port security alerts, so I want to limit the amount of notifications sent of this event via e-mail.
The ‘Time Interval’ one would be ideal but doesn’t have the option of ‘Maintain individual threshold counts for each host address’ which I would require as I have numerous switches
The ‘Threshold Filter’ one is not ideal as the events occur at random time intervals, dependant on host connecting, and can continue indefinitely (till host is disconnected), or perhaps someone might connect an ‘unauthorized’ device and disconnect immediately, with perhaps only one trigger of the event appearing on switch (which I still need to capture and want to be notified about). Therefore I cannot really set an adequate value in the ‘X’ field ('X' as per KiwiSyslog 'Help') that will cover both scenarios of multiple alerts or a single alert.
In addition ‘Maintain individual threshold counts for each host address’ doesn’t cover for multiple devices on the same switch, triggering separate events for different ports, so even if it was available as an option on the ‘Threshold filter’ I would still not be covered.
