Hi Jeffrey,

An easy way to do this from an operational engineering standpoint is to add an association rule to your port alerts which exclude ports with a certain string in their ifAlias (port description).

Like :

IfAlias notmatch *IGNORE*

Would exclude from the alert any port with "IGNORE" in its description.

You need to regenerate the alerts after changing the associations, else you need to wait for discovery for the changes to be picked up.

Adam.

Sent with AquaMail for Android
http://www.aqua-mail.com

On 15 September 2015 00:12:15 "Jeffrey d'Ambly" <jeffrey.dambly@jasper.com> wrote:

I’m using Observium Enterprise, and I have an interface that is running close to 100% traffic that I would like to ignore. This interface is a network tap/span for our IDS device. What  can I do in the alert checker to ignore alerts from this interface?

—Jeff

_______________________________________________
observium mailing list
observium@observium.org
http:/​/​postman​.​memetic​.​org/​cgi-bin/​mailman/​listinfo/​observium