Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: I'm receiving hundreds of logs for users with Login Failure

$
0
0

There's no real way for the LEM to limit logs in a setting like this.  The best you could hope for would be eliminating all logon failures from view on the LEM and that's not really something most want to entertain.

 

You'll want to check into what is causing this from the Cisco side.  Additionally, while this particular event may not have source/destination information it's fairly common for vendors to log other events alongside so you see 2-3 events for the same thing and can check the associated events for additional information. I would do a search +/- 5 minutes from one of these situations and see if you can find it, or review the syslog data directly.

 

Here's some articles with information that may relate to what you're seeing, otherwise you may want to engage Cisco and see if they can provide you with the root of these messages:

 

Solved: ACS does not allow local users to authe... - Cisco Support Community

 

ACS Online Troubleshooting Guide - Common Problems  [Support] - Cisco Systems


Viewing all articles
Browse latest Browse all 5385

Trending Articles