10-28-2022 10:36 AM
I have created an alarm configuration to send me an email if a switch experiences a SpanGuard event the locks out a port on my EOS switches.
I have the alarm definition setup as follows:
The email comes through fine, but I get 3 copies of one email and a single copy of another email with the same alert. You can see the Information column below is the email I see and the "Seen Count" is the number of emails that are sent to me.
I have gotten the second alarm to only send me a single email by setting up the Alarm Suppression rule in the Actions tab of the rule creation window
I still get the top alarm emailed to me though and I cant figure out how to eliminate multiple emails from being sent.
I also feel there is probably a better way to filter the rule so that the second alert isnt "seen" 3 times.
I have tried altering the Match On: Log: criteria field to include or exclue Syslog and the other, but have not found anything that works. Its almost like XIQ-SE is getting 4 syslog events evertime I reproduce the issue.
Thanks for any guidance.
10-29-2022 11:25 PM
Check how many events you get from switches. Check those events. are you getting the same log message multiple times? Are those messages equal or different?
10-31-2022 09:32 AM
Three of the messages are the same and the fourth is in a slightly different format but with the same details.
This is the identical message I will get 3 copies of:
This is the second message I get a single copy of:
Blacked out portions are the IP address of the switch.
11-01-2022 02:58 PM
thank you for sharing emails. I am interested in the original events. can you find those events in Alarms > Events > Syslog
11-02-2022 07:05 AM