[nv-l] [nv 7.1.4] Suppressing duplicate clogMessageGenerated traps prior to reaching TEC

["Van Order, Drew \(US - Hermitage\)" <dvanorder@deloitte.com>]

Hi all,

I have searched the list archives and read the Admin guide--and must be doing something wrong. I am trying to implement a Thresholds rule to pass the first trap, then suppress the rest for 30 minutes. I want to suppress duplicates based on the enterprise ID and Origin (IP address). There is only one trap associated with this enterprise ID.

I take this as the settings should be:

Type is First
Count is 1
Time Period is 30
Attribute 1 is Origin

Cycle daemons--not working. Have also tried setting EnterpriseID as Attr 1 (even though it's default) and Origin as Attr 2. Have also tried setting the count to 2. I have put this object in between the Trap Settings and Forward objects, and have also put in between Event Stream and Trap Settings. I see numerous events at TEC. What am I doing wrong?

Thanks for helping a rook with a rook question!

Drew Van Order
ESM Architect
(615) 882-7836 Office
(888) 530-1012 Pager

This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited.