Kaseya Community

Ignore events not working.

  • Here's my event set for Symantec AV Events:

    <event_sets>
      <set_elements setName="Symantec AV Events" eventSetId="86081622">
        <element_data ignore="0" source="Symantec AntiVirus" category="*" eventId="-1" username="*" description="*"/>
        <element_data ignore="1" source="Symantec AntiVirus" category="*" eventId="46" username="*" description="*"/>
      </set_elements>
    </event_sets>
    
    The expected behaviour here is that it should trigger for every Symantec AntiVirus event except eventID 46. That's not what I'm getting. It triggers on every event, which causes multiple tickets created for every suspect found on a system (SAV reports event 5, 46 and 51 for pretty much everything it finds, and ofter multiple times for each find). Anyone else having trouble with ignore events still?

    Legacy Forum Name: Ignore events not working.,
    Legacy Posted By Username: Lmhansen



    [edited by: Brendan Cosgrove at 12:40 PM (GMT -8) on 12-13-2010] .
  • You're definitely not the only one! I have a ticket open for this issue. Originally I was told it had been resolved in a hotfix and to re-apply my event sets (so if you haven't done this, you might try to see if that fixes your issue). However after making sure I was fully hotfixed and re-applying my event sets, I still see many events that should be ignored generating alerts. Haven't heard back from support yet, but I only re-opened the ticket this morning.

    Legacy Forum Name: General Discussion,
    Legacy Posted By Username: arobar
  • I too have this same issue since the upgrade . . . driving me nuts . . . was told i would get a call back on monday morning.

    Legacy Forum Name: General Discussion,
    Legacy Posted By Username: jbutina
  • Please remember to post back any info on how to restore the ignore ability. Thanks.

    Legacy Forum Name: General Discussion,
    Legacy Posted By Username: Alan M
  • It seems to be working now. I guess a patch was released for it at some point in the last few days. I cannot say when it happened, because I just spent 24 hours at a client site, but I did add some Event IDs to our Ignore filter, and those events are no longer sending me e-mails. Smile

    Legacy Forum Name: General Discussion,
    Legacy Posted By Username: Lmhansen
  • I'm still having this problem, ignore is NOT working

    Legacy Forum Name: General Discussion,
    Legacy Posted By Username: patrickvs