Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I couldn't care less about port scans and I like to have alerts emailed to me. Instead of seeing important alerts (losing a WAN line, catching malware, etc) I'm getting tons and tons of "possible port scans." Its incredibly annoying and so far I cannot find any way to turn them off without turning off all alerts. Please tell me this is possible. Thanks!

share|improve this question
I ended up disabling the email alerts because of it sending too many emails. Could you post what categories are checked under the alert column on the Logs -> Categories page? I currently have Attacks and System Errors, and I think Attacks should be unchecked. – KJ-SRS Feb 23 '11 at 23:26
It looks like its in the category "Intrusion Detection." If I shut that off I lose all my ID alerts. Oh well, maybe I'll just leave it on. Its a shame I can't just disable that one rule. – DrZaiusApeLord Feb 24 '11 at 14:37
up vote 1 down vote accepted

Doesn't look like its possible without disabling all IDS alerts.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.