Unsolved
1 Rookie
•
2 Posts
0
53
January 16th, 2026 15:25
OME 4.6 - Unable to suppress alerts
Rather than upgrade my OME 4.5 appliance, I opted to stand up a new 4.6 appliance. In the 4.5 appliance I have created an alert policy that ignores failed login attempts (alert CUSR1219). I am unable to reproduce this policy the 4.6 appliance. I've tried two different alert policies: a policy that ignores alerts for category All\Built-in\Application\Audit\Users, and a policy that ignores message ID CUSR1219. Neither of these alert policies suppress an email notification for a failed login attempt.
For the backstory, we have a user that logs into OME occasionally with a privileged account they only use for OME, and they frequently fat-finger their password. I want OME to email only actionable alerts, hence the desire to suppress email alerts for CUSR1219.
DELL-Joey C
Moderator
•
4.1K Posts
0
January 19th, 2026 01:56
Hi,
Just to confirm, you are referring invalid logins within OME right? Not iDRAC login.
With reference: https://www.dell.com/support/manuals/en-us/dell-openmanage-enterprise/error_event_message_guide/cusr%E2%80%94users-event-messages?guid=guid-d030e48d-8058-48f5-895e-7f3c01275426&lang=en-us CUSR1219 might not be a valid rule for the policy to work. Could it be that you can try using CUSR2003 or CUSR1226?
I did find CUSR1219 error prompt for iDRAC/LCC: https://downloads.dell.com/Manuals/all-products/esuprt_ser_stor_net/esuprt_poweredge/poweredge-r740xd_Reference-Guide2_en-us.pdf
COL-Dave
1 Rookie
•
2 Posts
0
January 20th, 2026 21:07
@DELL-Joey C Thanks for the response Joey. Yes, this is an alert generated by a failed login to OME. In 4.5 I have a policy to email all warning and critical alerts. I have a second policy to ignore alerts with CUSR1219, and this has been working flawlessly through multiple upgrades of OME. I got it to work in 4.6 by tweaking my 'email all alerts' policy to exclude category All\Built-in\Application\Audit\Users. This might be too broad of an exclusion though.