Configuring an Event Rule so SPECTRUM will not alarm on a single instance of an Authentication Failure trap (Legacy KB ID CNC TS30976 )

Document ID : KB000051905
Last Modified Date : 14/02/2018
Show Technical Document Details
The solution is to create an Event Rate Counter or Event Rate Window rule on the 0x1030a event using the Event Configuration Editor. Follow these basic steps:


1. Launch the Event Configuration Editor


2. Find and select the 0x1030a event


3. Create a copy of the 0x1030a event and make a note of the new Event ID


4. Remove the alarm assertion from the 0x1030a event


5. Create an Event Rate or Event Rate Window event rule on the 0x1030a event. Choose the number of occurrences, set the time interval and select the Event ID created in step 3 as the event to generate.


6. Update the SpectroSERVER Event Cache.


The following is an example of how the new EventDisp entry would look like if the an Event Rate Counter rule were configured to generate event 0xfff00000 if 5 Authentication Failure events (0x1030a) occurred within 10 seconds.


 0x1030a E 50 R CA.EventRateCounter, 5, 10, "0xfff00000 -:-"


For more information configuring events in SPECTRUM, please refer to the "Event Configuration Editor User Guide" and "Event Configuration Files Guide" for SPECTRUM 8.1 and the "Event Configuration User Guide" for SPECTRUM 9.0.



Related Issues/Questions:
Configuring an Event Rule so SPECTRUM will not alarm on a single instance of an Authentication Failure trap

Problem Environment:
Authentication Failure Trap
0x1030a
All versions of SPECTRUM

Causes of this problem:
Many SPECTRUM users have asked how to configure SPECTRUM so it does not alarm on a single instance of an Authentication Failure trap but wait until it has received X number of Authentication Failure traps in a specified time period.


(Legacy KB ID CNC TS30976 )