Cisco Acs 57 User Guide

29   
Managing Alarms
Creating, Editing, and Duplicating Alarm Thresholds
Related Topics
Creating, Editing, and Duplicating Alarm Thresholds, page 10
Configuring General Threshold Information, page 16
Configuring Threshold Notifications, page 35
RADIUS Sessions
When ACS evaluates this threshold, it determines whether any authenticated RADIUS sessions have occurred in the past 
15 minutes where an accounting start event has not been received for the session. These events are grouped by device 
IP...

30
Managing Alarms
 
Creating, Editing, and Duplicating Alarm Thresholds
Unknown NAD
When ACS evaluates this threshold, it examines the RADIUS or TACACS+ failed authentications that have occurred during 
the specified time interval up to the previous 24 hours. From these failed authentications, ACS identifies those with the 
failure reason Unknown NAD. 
The unknown network access device (NAD) authentication records are grouped by a common attribute, such as ACS 
instance, user, and so on, and a count of...

31   
Managing Alarms
Creating, Editing, and Duplicating Alarm Thresholds
Related Topics
Creating, Editing, and Duplicating Alarm Thresholds, page 10
Configuring General Threshold Information, page 16
Configuring Threshold Notifications, page 35
External DB Unavailable
When ACS evaluates this threshold, it examines the RADIUS or TACACS+ failed authentications that have occurred during 
the specified interval up to the previous 24 hours. 
From these failed authentications, ACS identifies those with the...

32
Managing Alarms
 
Creating, Editing, and Duplicating Alarm Thresholds
You can specify one or more filters to limit the failed authentications that are considered for threshold evaluation. Each 
filter is associated with a particular attribute in the records and only those records that match the filter condition are 
counted. If you specify multiple filter values, only the records that match all the filter conditions are counted.
Choose this category to define threshold criteria based on an external...

33   
Managing Alarms
Creating, Editing, and Duplicating Alarm Thresholds
RBACL Drops
When ACS evaluates this threshold, it examines Cisco Security Group Access RBACL drops that occurred during the 
specified interval up to the previous 24 hours. The RBACL drop records are grouped by a particular common attribute, 
such as NAD, SGT, and so on.
A count of such records within each of those groups is computed. If the count for any group exceeds the specified 
threshold, an alarm is triggered. For example,...

34
Managing Alarms
 
Creating, Editing, and Duplicating Alarm Thresholds
Related Topics
Creating, Editing, and Duplicating Alarm Thresholds, page 10
Configuring General Threshold Information, page 16
Configuring Threshold Notifications, page 35
NAD-Reported AAA Downtime
When ACS evaluates this threshold, it examines the NAD-reported AAA down events that occurred during the specified 
interval up to the previous 24 hours. The AAA down records are grouped by a particular common attribute, such as device...

35   
Managing Alarms
Creating, Editing, and Duplicating Alarm Thresholds
Related Topics
Creating, Editing, and Duplicating Alarm Thresholds, page 10
Configuring General Threshold Information, page 16
Configuring Threshold Notifications, page 35
Configuring Threshold Notifications 
Use this page to configure alarm threshold notifications.
1.Select Monitoring and Reports > Alarms > Thresholds, then do one of the following:
Click Create to create a new alarm threshold.
Click the name of an alarm...

36
Managing Alarms
 
Deleting Alarm Thresholds
Related Topics
Viewing and Editing Alarms in Your Inbox, page 3
Creating, Editing, and Duplicating Alarm Thresholds, page 10
Deleting Alarm Thresholds, page 36
Deleting Alarm Thresholds
To delete an alarm threshold:
1.Select Monitoring and Reports > Alarms > Thresholds.
The Alarms Thresholds page appears.
2.Check one or more check boxes the thresholds you want to delete, and click Delete. 
3.Click OK to confirm that you want to delete the selected...

37   
Managing Alarms
Understanding Alarm Syslog Targets
Use this page to enable system alarms and to specify where alarm notifications are sent. When you enable system 
alarms, they are sent to the Alarms Inbox. In addition, you can choose to send alarm notifications through e-mail to select 
recipients and as syslog messages to the destinations specified as alarm syslog targets.
From the Monitoring and Report Viewer, choose Monitoring Configuration > System Configuration > System Alarm 
Settings. 
This...

38
Managing Alarms
 
Understanding Alarm Syslog Targets
Note: You can configure a maximum of two syslog targets in the Monitoring and Report Viewer.
This section contains the following topics:
Creating and Editing Alarm Syslog Targets, page 38
Deleting Alarm Syslog Targets, page 39
Creating and Editing Alarm Syslog Targets
To create or edit an alarm syslog target:
1.Choose Monitoring Configuration > System Configuration > Alarm Syslog Targets.
The Alarm Syslog Targets page appears.
2.Do one of the...