IPS 7.0 - Event Action Filter Question

bryguy

Anyone know the difference between an event action filter that is enabled and an event action that is active?

Can an event action filter be disabled and in active status at the same time? Thanks in advance for any input.

bryguy

Found the answer in one of Cisco's support forums... apparently, I'm not the only one who was confused by the wording in the Cisco documentation. "Event action filters are evaluated in a specified order. Active means that a filter participates in the order. Enabled means that it can perform a filtering action. Use Disable when you want to preserve the order, but not perform the action (e.g. if you want to turn it off for debugging, but want to keep it's place in the list later). Use Inactive when you don't want the filter in the ordering at all (e.g. if you want to keep it as a reminder, but don't plan to use it again). The filter list is displayed by CLI and IDM in logical order - first all of the Active filters in their specified order, and then all of the Inactive filters. I don't think the designers really intended to have 2 similar options; it is more a side effect of the data model used for storing the configuration." Another fun feature!