About Alerts

AirWave displays summary information about alerts, including the alert type and how many times an event occurred over the past 2 hours and the last 24 hours. For more information about alerts, see Viewing System Alerts.

You can view the Alert table from the following WebUI pages:

• Devices > List
• Devices > Monitor
• Groups > Monitor
• Home > Overview
• Clients > Connected or Client Detail
• System > Alerts

When you click the hyperlinks in the Type column, a detailed view for the selected type of alert opens.

Figure 1  Alert Summary

Information about AMP Alerts include:

• Trigger Type: Name of the AMP Alert trigger
• Trigger Summary: Description of the AMP Alert trigger
• Triggering Agent: MAC address of the device that triggered the alert
• Severity: Alert severity level
• Time: Timestamp for the alert

Information about IDS Events include:

• Severity: Event severity level
• Category: IDS category for the event
• Scope: Indicates of the scope of the IDS event impacts an AP, Client or AP, Client or Probe.
• Attack: Name of the IDS Event
• Detail: Details about the IDS Event type, if available
• Attacker: MAC address of the device that triggered the IDS event
• Target: MAC address of the device that was the target of the IDS attack
• Time: Timestamp for the event

Information about RADIUS Accounting Issues and RADIUS Authentication Issues include:

• Event: Name of the RADIUS event
• Username: user name of the device that triggered the event
• Client MAC Address: MAC address of the client that triggered the event
• Client IP address: IP address of the client that triggered the event
• AP/Device: AP or device to which the client is associated
• BSSID: BSSID of the AP radio
• Radio: PHY type of the AP radio (e.g., 802.11a, 802.11ac, etc.)
• Controller: Name of the Controller to which the device is associated
• RADIUS Server/RADIUS IP: Server name and IP address of the RADIUS server
• Time: Timestamp for the event

Viewing System Alerts

The top header of each AirWave WebUI page provides direct links to alerts and severe alerts. You can also navigate to System > Alerts to view these alerts and acknowledge or delete them. You can identify alerts by color-coded icons. For example, alerts with high severity are red and warnings are blue. For information about setting the severe alert threshold, see Setting Severe Alert Warning Behavior.

Figure 2  Example of GRE Tunnel Alerts

The System > Alerts page displays the information described in Table 1.

Table 1: System > Alerts Fields and Default Settings

Field	Description
Trigger Type	Displays and sorts triggers by the type of trigger.
Trigger Summary	Provides an additional summary information related to the trigger.
Triggering Agent	Displays the name of the device that generated the trigger. Click the hyperlink to open the Devices > Monitor page for that device.
Time	Displays the date and time the trigger was generated.
Severity	Displays the severity code associated with that trigger
Details	Displays additional details for alerts.
Notes	Displays any notes that you have added.

Viewing Details

When you click the triggering agent hyperlink for a GRE Tunnel alert, AirWave displays GRE Tunnel Details in a table at the bottom of the controller monitoring page, as shown in Figure 3.

Figure 3  GRE Tunnel Details