Disable Noisy message ID
We have one corelation rule for device Cisco switch ; and selected some event category ...I want to disable single message ID from that event category but dont want it do it from rule...I dont want that message id should fire any alerts..any sugeestion.
I think the best way is to move away from category and just select the message IDs that you want to include in the alert. If you go the filtering route, you would have to filter out specific text from the [CONTENT] of the message. I think this is inefficient. It is better to just look at the category in manage messages and select all of the message IDs that you want to include, esp. since it is just a matter of checking multiple boxes.