Rogue Rules and Rogue AP alert in Prime

Hi Supportcommunity,
i have done a lot of research according this topic but i was unfortunately unable to find an helpful post.
If i missed something I am sorry about.
I got the following issue my customer complains about Rogue AP Alerts in Cisco Prime.
There are always many of them.
I already configured the Rogue Rules at the WLC´s security tab as follows.
Here are the rules in detail.
1st rule
2nd rule
3rd rule
Could you please help me to understand what I did wrong.
I dont understand why there are still so many Rogue warnings although I configure it to not alert.
Thanks for your support
With kind regards
Benedikt

Rogue detection is a way of being aware of other APs in your surroundings, I would not advise on turning the SNMP traps off totally. On the other hand the customer cant really blame you because there are other APs around their network? In 99,9% of all networks there will be....
However, if you want to tidy up among the rogue alarms, the rules can be used.
What your rules are saying is "Anyone except me using my SSIDs? - mark it as a Bad Guy" (OK).
Then it gets a bit weird to me, lets do a short one on Signal strength:
- 30 dBm = Less than one meter from the AP at max European output level 20 dBm EIRP
-40 dBm = Ten times weaker, some 2-4m from AP. All distances are roughly speaking...
-50 dBm = 1/100 weaker, less than 10m from AP
-60 dBm = 1/1000 weaker, some 16m from AP, a "normal" and strong signal
-70 dBm = 1/10000, within 30m from AP, not great, but lower end of "normal" span
-80 dBm = hardly useable signal, might be able to connect @ 1-2 Mbps, not much more
-90 dBm = almost no clients can use this weak levels
-100 dBm = background noise.
You delete rule says that "Any other AP located less than a meter from mine (-30 dBm) should be marked as Malicious and deleted". Lower this to, say -70 dBm and see what happens.
Also note that the order of the rules can be important. It runs from top down, and as far as I remember the last one that matched determines if it is Friendly or Malicious. Play around with the levels first, then if necessary the order of the rules, and get back...
**Please rate helpful posts**

Similar Messages

Configure WCS to limit SNMP Trap to only Rogue AP alert

Hello all,
Is there a way to limit SNMP traps sent by WCS to only Rogue AP Alert? I know I can configure WCS to send email notification for Rogue AP Alert, but couldn't find anything similar for SNMP traps.
Also, where can I find WCS MIBS and OID for Rogue AP Alert?
Thanks.

https://tools.cisco.com/bugsearch/bug/CSCue09354 may be this is root of problem, when I use native vlan on access port WLC can found rogue ap on wired network... but i use version 7.4.121

Rogue AP alerts from WCS 4.1.83

I'm looking for a way to make rogue AP alerts generated by WCS more user friendly. Ideally I'd like the names (not Mac address's) show up in the alerts. Is anyone doing this?

I think he means the names of the LWAPs, not the rogues themselves. It is kind of a fudge that you have to go search your AP list to figure out where the rogues are, unless of course you have memorized every radio MAC on your network :-)

Outlook 2007 Rules and Alerts won't open

User complained of receiving duplicate emails after adjusting rules. I chose to open "Rules and Alerts" from Tools on the tool bar. When opening "Rules and Alerts" a box flashes on the screen and I am unable to view any of the Rules.
I am able to create a new profile and then open the rules. I attempted the outlook /cleanrules command, I was still unable open rules. (It is a Windows 7 OS). Any ideas, if I need to use a new profile what is the best way to move all of the
other outlook info without moving the problem?

I am not sure if this issue is has been resolved but here is the fix. I have been having the same problems for a couple months now until today when I decided to fix it.
When you mentioned OWA that got me thinking because outlook rules are workstation standalone (it will apply if the system and outlook is running) the issue is with OWA. If you have ever modify your rules in OWA you will have the problem.
FIX:
Log onto OWA and go to the options settings.
Go to Rules and try deleting a rule. It should say something like several rules error or something.
LEAVE OWA running and open Outlook.EXE (pretty much just open outlook), preferably, on the computer you set the rules in the first place if you still have it. If not, it is ok.
On your Desktop Outlook, click on Rules and your pop-up should remain up. Delete the olds rules, yes, all of it.
Refresh OWA to make sure all rules have been deleted. If they have, great. If not, repeat the steps again - Log out of OWA, close outlook and open it back up. Now you can create new rules.
OWA Should have no more rules. In the future, make sure you don't make any changes to existing rules in OWA

Can't open Manage Rules and Alerts after adding a shared MB

Have a customer who is using a Terminal Server Environment, all server's 2008 R2 and we're using Exchange 2010.
Office 2010 installed on all server's.
If they add an additional mailbox to Outlook 2010, user's are then unable to open rules & alerts, no error message. It flickers and then nothing happens.
Nothing in event logs that I can see that suggests anything.
If I load up OWA, add a mailbox and then try to open mailbox - it works OK.
Outlook has been re-installed.
Office 2010 has latest service pack.
If you load up the shared mailbox on it's own, the rules and alerts works fine.
Seen a few threads relating to this but none of them seem to have a fix on there.
Any ideas?
Thanks in advance,
Lee,

Hi Lee,
I have a test in my environment using Exchange 2010 with Outlook 2010. I couldn't reproduce this issue in my environment. In your case, make sure that this customer has full access to shared mailbox. And then follow the steps below to add shared mailbox
to the customer's account and check the result.
open Outlook -> File -> Account Settings -> Change -> More Settings -> Advanced -> Add -> type shared mailbox name -> Ok
If the issue persists, use Outlook safe mode to determine whether the problem is caused by add-ins.
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

Notification Rules and Alerting

I created 5 rules from the section "Notification Rules" using same user ID.
Is it possible to alert different email groups for each notification rule from the same ID. We select "send e-mail" option from the Notification Rules section, we will be recieving alerts for the e-mail ID that was configured in the General Section under --> Preferences. How do we configure the rules to notify different group's using the same ID.
Thanks in advance.

Hi Loc,
Can you please help me in finding the "Add Actions page (2nd step in The Edit rule set process)" I cannot find that option when I select the rule and say EDIT --> Actions page --> "E-mail notification, Advanced notofocation Methods and Clear Alert(These are only the options available in Actions page)".
Sorry for asking the basic stuff... FYI - I am actually using OEM 11.1.0.1

RULES and ALERTS in Workflows

Hi Experts,
Can anybosy help me with Rules and Alerts in Workflows. I have searched the FORUM but nothing I got that is related to RULES.
Anybody has any material that could prove helpful for me.
With Best Regards,
Kanika

Hi Kanika,
Hope the following link be useful to you regarding RULES in Workflows.
https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/70c6c6e7-3ede-2a10-deb8-8da2071fbaf0
Thanks
Nitesh

Outlook "Manage Rules and Alerts" flashes and wont fully open

Hi ,
one of my custom got a tricky problem. His rules flashes on every PC. have tried change pc, reinstall outlook for several version (2k3,2k10,2k13). For server side, Exchange2010, have tried move user to another mailboxdabase. but nothing worked.
Each time i click "manage Rules and alerts", a log will recorded in windows app log "operation fail", Event id 27(not sure the exact words in english version. it is “操作失败” in chinese). detail message :
System
Provider
[ Name]
Outlook
EventID
27
[ Qualifiers]
16384
Level
4
Task
0
Keywords
0x80000000000000
TimeCreated
[ SystemTime]
2014-04-08T00:58:05.000000000Z
EventRecordID
740183
Channel
Application
Computer
XXXXXXXXXXX.com
Security
EventData
操作失败。
I think it is a server-side problem, until i found OWA works fine. which really drive me crazy.
after some google, and search in forum, i found a similar thread: http://social.technet.microsoft.com/Forums/office/en-US/f6b75a36-9af9-4153-a5f9-57061a5729c0/outlook-2010-manage-rules-and-alerts-only-flashes-and-wont-fully-open?forum=exchangesvrclientslegacy
After follow the advise to delete all rules via MFCMAPI tool, seems still not help. i could only post a question here.
thanks for any advise
Go Patriots

Glad to hear that. For the "Stop Processing More Rules", you can refer:
http://www.outlook-tips.net/tips/tip-42-stop-processing-more-rules/
http://www.msoutlook.info/question/340
Best Regards,
Steve Fan
TechNet Community Support

Outlook 2013, Exchange 2010 error with Rules and Alerts

Hello,
I was recently informed by a user that when they open Outlook 2013 and click Manage Rules and Alerts, they get the following message:
By the way, NO Microsoft, this information is not helpful. Anyways, I found that the same problem is happening in my Outlook as well. I do not believe it is happening to all users' accounts, and I am able to set up Rules within Outlook Web Access,
so it seems to be some local setting. I found a lot of forums suggest running the Outlook /cleanrules switch, and this did not fix the problem. Other suggestions are to delete the profile on the computer and/or uninstall outlook and reinstall it.
I don't like these solutions, as they don't point to the true source of the problem and do nothing to help avoid this problem in the future. Has anybody else had this problem and been able to fix it? We are running Exchange 2010 in our environment,
although not sure if that makes a difference or not. Any answers that do not suggest the things I have already mentioned would be greatly appreciated!

Hi,
For this issue, I recommend you ask in Office forum which is staffed by more experts specializing in this kind of problems. You might get better help there.
http://social.technet.microsoft.com/Forums/office/en-us/home?forum=outlook
Thanks for your understanding.
Best regards,
Belinda Ma
TechNet Community Support

OEM Multiple Notification rules and schedules

Hi,
We have OEM 10.2.0.4 installed in our environment.
As a DBA i get the notification for all kind of alerts (warnings/critical).
My manager wants to see only the critical alerts to be send to him. How can this be implemented.
I created custom notification rules just for critical alerts. How can i now have a separate schedule just for these new notification rules.
When I go to the schedule page. It does not seems to have a 'create' button so that I can create multiple schedules and associate different schedule to different rules etc...
Any help in this regard would be appreciated.
Thanks.

Thanks for you reply.
Do you mean I need to create a new Administrator user?
Has anybody in this forum have implemented this? Please share the steps you have followed.
Thanks.

Script to change the priorty of all rules and monitors in a Management Pack

Script to change the priority and severity of all rules and monitors in a Management Pack in an override MP .We are deploying an MP in production and don't want the helpdesk to take any action on any alerts, so want to set all of them as informational.Once
they are reviewed then we will delete that override mp
Can some one help me with a script

Is this MP sealed? Doesn't really matter.. Unseal the MP if it is sealed. Now you have access to the RAW XML. Alert severity and priority have xml tags. You should be able to do a search and replace and change all the various
levels (0-3 or whatever they are) to the levels and priority you want.
Then you can seal the mp with your own key, or just roll it into prod as an unsealed MP.
This seems, to me, like the quickest and easiest way to make all of these changes at once. To bulk override everything, not even sure it's still around or even works, there was a tool called Override Explorer, and you could select multiple monitors/events
and create overrides. I can't remember very much about the tool because we didn't use it much, but I think it did this with live data, meaning it connected to your management server, and you made the changes in real time.
Of course you wouldn't want to do this in production, so do it in a lab, then export the override mp and put it in prod.
There is probably some snazzy way to do this with PoSh, but I am not aware of any atm.
Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/ If my response was helpful, please mark it as so, if it answered your question, then please also mark it accordingly. Thank you.

Outlook 2016 getting crashed and throws an alert message as "microsoft outlook has encountered a problem and needs to close.

Hi,
Today i installed Microsoft Office 2016 preview for my Mac OS X 10.10 Yosemite. Word, Excel and Powerpoint applications are working without any problem. However, Outlook getting crashed and throws an alert message as "microsoft outlook has encountered a problem and needs to close.", it's happens always, when i launch outlook. please suggest me, how can i comet from this issue.
Thanks in advance,
Suresh Balakrishnan.

Go to the Microsoft site for help. These forums are not offering support for MS products, especially not for beta products.

In r12 What is use of Purge log and Closed system alerts

Hi
In r12 What is use Concurrent reqest "Purge logs and Closed system alerts "
is there any diffrence with "Purge Concurrent Request and/or Manager Data Program"
we have to purge cm logs and data.
'

In r12 What is use Concurrent reqest "Purge logs and Closed system alerts "The concurrent program "Purge Debug Log and System Alerts" (Short name: FNDLGPRG) is the recommended way to purge messages. This program purges all messages up to the specified date, except messages for active transactions (new or open alerts, active ICX sessions, concurrent requests, and so on). This program is by default scheduled to run daily and purge messages older than 7 days. Internally this concurrent program invokes the FND_LOG_ADMIN APIs, which are described later in this document.
Oracle® Applications Supportability Guide Release 12
http://download.oracle.com/docs/cd/B40089_09/current/acrobat/120fndsupp.pdf
is there any diffrence with "Purge Concurrent Request and/or Manager Data Program" This concurrent program is used to purge concurrent requests log/out file, and/or CM log files.
we have to purge cm logs and data.Use "Purge Concurrent Request and/or Manager Data" concurrent program.

Unable to find Transfer Rules and Data Source for 0PERSON Info Source

Hi,
I'am working on SALES ANALYSIS Configuration with the help of SAP Best Practices.
I'am trying to load Master Data Attributes/Texts/Hierarchies.
I'am able to load for allmost all the InfoPackages which i created for particular DataSource.
Now i need to load master data for 0PERSON InfoObject under that Person (Attributes) and Person (texts) are there,for this 2 Transfer Rules and the DataSource has to be defined by default as it is defined for other Attributes/Texts/Hierarchies.But i'am unable to find a DataSource and Transfer Rules to create a infopackage for PERSON Attributes and Texts.
Please gudie me with a solution in order to get these Transfer Rules and DataSource for this Attributes and Texts.
With regards,
Pradeep.B

Hi,
Install the corresponding master data objects from Business content. Go to data source find out the needed datasource, replicate it. If you want you can migrate it also.
If still you are not getting 0person masterdata object datasource & transformation structure, then you have to create the transformation, Infopackage.
Hope if you will install the business content again, it will solve your problem.

Set up rule and lost mail!

I thought I was doing a 'good' thing when I set up a rule in Mail that said if the email address does not contain my exact email address, please move it to the junk folder. I set it up for both my cable company's email address and for my Mac address. Went back into Mail- all messages gone from both accounts!! Wiped out. So I went back into Rules and removed both rules. The Mac mail reappeared but my cable company emails did NOT reappear. Now I can probably recover them cuz I back up every morning but since the backup this morning, of course I have gotten some emails which did not get backed up. What happened?! Where did they go? Can I get them back? Ugh! Judy

I tried rebuilding the mailbox and that didn't help. Judy

Rogue Rules and Rogue AP alert in Prime

Similar Messages

Maybe you are looking for