Change severity of "Login Failed" event?

[Jesse Peterson]

We have SIM configured to page engineers for Major & Critical events. The "Login Failed Authentication" event falls under the Major category by default, so a page goes out every time someone mistypes a password. We've adjusted trap severity for things like firmware updates, but I haven't been able to find a corresponding setting for login events. Does anyone know of a way to change the severity level of a "login failed" event? Even better than that would be if there was a way to modify the event to require something like 3 failed logins within a set time frame prior to generating an alert.

Thanks,
Jesse

[Jimmy Rueedi]

Hello all

same here, but with the message: "The contract or warranty for this system has expired"

It doesn't interest any engineer if a warranty status changes at midnight, while normal peaple is sleeping.... :-$

Hopefully anyone has an idea how to adjust the severities of internal events?

Regards Jimmy

[H.Y. Yiu]

you can look the alerts up in the mib files, change the severity and compile it. the mib files are in the ..\mibs directory of your sim installation directory.

[Jimmy Rueedi]

Unfortunately the question turns ot araound the Trap- Notifications.
The "Login Failed" or "The Contract or Warranty..." are not fired by SNMP- Traps.

Our question was: how to change the severity of those internal notifications?

Regards
Jimmy

[H.Y. Yiu]

OK, I suppose that you page using automatic event handling. Then you can exclude the login failed's out of your event collection. Something like severity = all Major & Criticals and event type is not "security events - login failed"