Can you provide details on how the filter is configured?
Are the Cisco event IDs in the message? Are there any rules before this one that may be matching first?
Clik here to view.

Can you provide details on how the filter is configured?
Are the Cisco event IDs in the message? Are there any rules before this one that may be matching first?