The issue is with the has changed condition. This condition is literally only their for IOS changes or node reboots. The code behind that condition is specifically coded for those two options. What you would probably have to do is create a SQL component in SAM that queries the events table for that event, and if found sets the component to down, then trigger the alert. Other than that, I'm not sure there would be a way to accomplish what you are looking for.
1 of 1 people found this helpful
Okay so I ended up going a different path I created a SQL job that runs every 5 mins and auto acknowledges the events.
SET [Acknowledged] = 1
WHERE [Message] Like '%Interface Speed changed from%'
AND [Acknowledged] = 0
AND [EventType] = 19
This should keep the huge amounts of changes out of your immediate view. For reports you will still need to figure out how to filter them out. This seemed better than just turning off the entire event type to me.
I know there is a lot of hubbub about not directly changing things in the database but an Admins got to do what an Admins got to do.
That's actually a pretty cool workaround there.