Server Management - Systems Insight Manager
cancel
Showing results for 
Search instead for 
Did you mean: 

Change severity of "Login Failed" event?

Jesse Peterson
Occasional Visitor

Change severity of "Login Failed" event?

We have SIM configured to page engineers for Major & Critical events. The "Login Failed Authentication" event falls under the Major category by default, so a page goes out every time someone mistypes a password. We've adjusted trap severity for things like firmware updates, but I haven't been able to find a corresponding setting for login events. Does anyone know of a way to change the severity level of a "login failed" event? Even better than that would be if there was a way to modify the event to require something like 3 failed logins within a set time frame prior to generating an alert.

Thanks,
Jesse
4 REPLIES
Jimmy Rueedi
Frequent Advisor

Re: Change severity of "Login Failed" event?

Hello all

same here, but with the message: "The contract or warranty for this system has expired"

It doesn't interest any engineer if a warranty status changes at midnight, while normal peaple is sleeping.... :-$

Hopefully anyone has an idea how to adjust the severities of internal events?

Regards Jimmy
H.Y. Yiu
Frequent Advisor

Re: Change severity of "Login Failed" event?

you can look the alerts up in the mib files, change the severity and compile it. the mib files are in the ..\mibs directory of your sim installation directory.
Jimmy Rueedi
Frequent Advisor

Re: Change severity of "Login Failed" event?

Unfortunately the question turns ot araound the Trap- Notifications.
The "Login Failed" or "The Contract or Warranty..." are not fired by SNMP- Traps.

Our question was: how to change the severity of those internal notifications?

Regards
Jimmy
H.Y. Yiu
Frequent Advisor

Re: Change severity of "Login Failed" event?

OK, I suppose that you page using automatic event handling. Then you can exclude the login failed's out of your event collection. Something like severity = all Major & Criticals and event type is not "security events - login failed"