I am receiving constant (about every 2-3 minutes) email notifications about New peer for interface.
I see it as an event (SYS_IF_PEER_CHANGED), but don't see a way to turn off emails regarding this. There is no corresponding item in event processing policy.
I have Cisco Meraki switches / routers / APs.
I tried to delete that item in event configuration, and it said access denied. I found it in the database itself, but wanted to ask here before attempting to delete that entry in the database.
This started a few versions ago, I don't remember which one, I'm currently on 3.7.145.
Any help is appreciated!
Hi,
if you got emails that means that somewhere you have rule that catches this event and sends an email. Maybe something generic, like all events from certain devices or with certain severity. Easiest way to turn off processing for this event is to add as first rule in EPP with condition set to just that event and action set to "stop processing".
Best regards,
Victor
Victor, thanks. That seems to have stopped them.
However, I expanded all the items in EPP and I have no items with SYS_IF_PEER_CHANGED except the one I created as you suggested and moved to the top.
I also kept getting similar messages about SYS_INCORRECT_NETMASK and I did the same thing you suggested and it stopped.
However, "Generate alarm when incorrect network mask detected on interface" is one of the out of the box rules, and I had that rule disabled, but the messages still kept coming.
Is there anything else I'm missing?
Most likely you have some sort of "catch all" rule that also triggered for those events without explicitly listing them (like "all events from object"). If you can show your full policy I can comment further.
Best regards,
Victor
Thanks Victor, I'm sure I'm missing something simple.
See below!
(https://live.staticflickr.com/65535/50992844563_4a5fd4ba7d_o.png)
(https://live.staticflickr.com/65535/50993657417_98cd8e877e_b.jpg)
(https://live.staticflickr.com/65535/50993657402_9eddc09986_o.png)
(https://live.staticflickr.com/65535/50993543176_ef6f38f307_o.png)
(https://live.staticflickr.com/65535/50993543151_41abd05b5b_o.png)
(https://live.staticflickr.com/65535/50993657367_729e17ef5c_o.png)
(https://live.staticflickr.com/65535/50992844493_d9eeb44294_o.png)
Rule number 5 - it has no condition, so it catches every event, and sends notification.
Best regards,
Victor
Victor, that seems to have done it... not sure how it became empty, but it's all quiet now.
Thanks!