Chapter 12 Managing Alarms

Creating, Editing, and Duplicating Alarm Thresholds

Table 12-15 ACS Configuration Changes

Option

Change

Filter

Description

Use the drop-down list box to select the administrative change on which you want to configure your threshold. Valid options are:

Any

Create—Includes “duplicate” and “edit” administrative actions.

Update

Delete

ACS Instance

Click Select to choose a valid ACS instance on which to configure your threshold.

Related Topics

Creating, Editing, and Duplicating Alarm Thresholds, page 12-11

Configuring General Threshold Information, page 12-13

Configuring Threshold Notifications, page 12-32

ACS System Diagnostics

When ACS evaluates this threshold, it examines the accounting records that it received during the interval between the previous and current alarm evaluation cycle.

If one or more accounting records match, it calculates the time that has lapsed since the previous alarm evaluation cycle. When it reaches two, three, or five minutes depending on the number of active thresholds, ACS examines system diagnostic records generated by the monitored ACS during the interval.

If one or more diagnostics were generated at or above the specified security level, an alarm is triggered. You can specify one or more filters to limit which system diagnostic records are considered for threshold evaluation.

Each filter is associated with a particular attribute in the records and only those records that match the filter condition are counted. If you specify multiple filter values, only the records that match all the filter conditions are counted.

Choose this category to define threshold criteria based on system diagnostics in the ACS instance. Modify the fields in the Criteria tab as described in Table 12-16.

 

User Guide for Cisco Secure Access Control System 5.3

12-22

OL-24201-01

Page 350
Image 350
Cisco Systems OL-24201-01 manual ACS System Diagnostics, 12-22