topic Re: Change severity of "Login Failed" event? in Server Management - Systems Insight Manager

Change severity of "Login Failed" event?

Jesse Peterson — Fri, 11 May 2007 09:31:51 GMT

We have SIM configured to page engineers for Major & Critical events. The "Login Failed Authentication" event falls under the Major category by default, so a page goes out every time someone mistypes a password. We've adjusted trap severity for things like firmware updates, but I haven't been able to find a corresponding setting for login events. Does anyone know of a way to change the severity level of a "login failed" event? Even better than that would be if there was a way to modify the event to require something like 3 failed logins within a set time frame prior to generating an alert.

Thanks,
Jesse

Re: Change severity of "Login Failed" event?

Jimmy Rueedi — Tue, 18 Dec 2007 13:28:13 GMT

Hello all

same here, but with the message: "The contract or warranty for this system has expired"

It doesn't interest any engineer if a warranty status changes at midnight, while normal peaple is sleeping.... :-$

Hopefully anyone has an idea how to adjust the severities of internal events?

Regards Jimmy

Re: Change severity of "Login Failed" event?

H.Y. Yiu — Mon, 31 Dec 2007 14:24:21 GMT

you can look the alerts up in the mib files, change the severity and compile it. the mib files are in the ..\mibs directory of your sim installation directory.

Re: Change severity of "Login Failed" event?

Jimmy Rueedi — Thu, 03 Jan 2008 12:10:32 GMT

Unfortunately the question turns ot araound the Trap- Notifications.
The "Login Failed" or "The Contract or Warranty..." are not fired by SNMP- Traps.

Our question was: how to change the severity of those internal notifications?

Regards
Jimmy

Re: Change severity of "Login Failed" event?

H.Y. Yiu — Thu, 03 Jan 2008 13:28:33 GMT

OK, I suppose that you page using automatic event handling. Then you can exclude the login failed's out of your event collection. Something like severity = all Major & Criticals and event type is not "security events - login failed"