Guest

Cisco Email Security Appliance

ESA FAQ: What is debounce timeout?

Document ID: 118113

Updated: Jul 31, 2014

Contributed by Nasir Shakour and Robert Sherwin, Cisco TAC Engineers.

   Print

Introduction

This document describes what a debounce timeout is and how to configure a debounce timeout on an Email Security Appliance (ESA).

  

What is debounce timeout?

The ESA will send alert notifications to a user via email if there is are system errors that require user intervention. If an error occurs frequently, the appliance can be configured to refrain from resending the identical alert for a specified period of time. This parameter is known as the debounce timeout.

Increasing the debounce timeout can be useful in certain circumstances, such as minimizing duplicate alert notifications while a hardware component is in the process of being replaced.

You can specify the initial number of seconds to wait before AsyncOS will send a duplicate alert. If you set this value to 0, duplicate alert summaries are not sent and instead, all duplicate alerts are sent without any delay (this can lead to a large amount of email over a short amount of time). The number of seconds to wait between sending duplicate alerts (alert interval) is increased after each alert is sent. The increase is the number of seconds to wait plus twice the last interval. So a 5 second wait would have alerts sent at 5 seconds, 15, seconds, 35 seconds, 75 seconds, 155 seconds, 315 seconds, etc.

 

Eventually, the interval could become quite large. You can set a cap on the number of seconds to wait between intervals via the maximum number of seconds to wait before sending a duplicate alert field. For example, if you set the initial value to 5 seconds, and the maximum value to 60 seconds, alerts would be sent at 5 seconds, 15 seconds, 35 seconds, 60 seconds, 120 seconds, etc.

 

> alertconfig

Sending alerts to:
ESA_Admin@mycompany.com
Class: All - Severities: All

Initial number of seconds to wait before sending a duplicate alert: 300
Maximum number of seconds to wait before sending a duplicate alert: 3600
Maximum number of alerts stored in the system are: 50

Alerts will be sent using the system-default From Address.

Cisco IronPort AutoSupport: Disabled

Choose the operation you want to perform:
- NEW - Add a new email address to send alerts.
- EDIT - Modify alert subscription for an email address.
- DELETE - Remove an email address.
- CLEAR - Remove all email addresses (disable alerts).
- SETUP - Configure alert settings.
- FROM - Configure the From Address of alert emails.
[]> setup

Initial number of seconds to wait before sending a duplicate alert.
Enter a value of 0 to disable duplicate alert summaries.
[300]>

Maximum number of seconds to wait before sending a duplicate alert:
[3600]>

Change the values of the two listed configuration parameters, and then issue commit to save any changes.

Tip: Remember, once you are completed with any hardware component troubleshooting or replacements, please change the alertconfig settings for the debounce timeout back to original values.

Related Information

Updated: Jul 31, 2014
Document ID: 118113