filter on events reported in AlertEmail

[ede_pfau]

hello fellows,

dumb question actually: sometimes I target alertemails of customer firewalls to me. Now, is there an option to filter which events get reported? Like in 'config log <dev> filter'? I'd love to cut out these webfilter messages which occur in hundreds per day.

Setting the alert level higher doesn't work for this as 'status=blocked' is at the 'warning' level, as are other more serious events.

[Jeff_FTNT · Accepted solution]

You may try ways to restrict Alert email for Webfilter event.

### Based on event

config alertemail setting     set filter-mode category     set webfilter-logs disable     set admin-login-logs enable end ### Based on event log level, change interval to 1440min/1 day  for  "warning" level event. config alertemail setting     set filter-mode threshold     set warning-interval 1440 end

Thanks.

[ede_pfau]

Thanks Jeff, I thought it was a dumb question, so obvious...