Disabling Individual Signatures

Use the global configuration mode command ip audit signature to attach a policy to a signature. You can implement two policies: disable a signature or qualify the audit of a signature with an access list. This command is generally used to disable the auditing of a signature or to exclude specific hosts or network segments from being audited. Use the no form of this command to remove the policy. If the policy disabled a signature, then the no command re-enables the signature. If the policy attached an access list to the signature, the no command removes the access list. The syntax is

Rtr1(config)#ip audit signature signature-id {disable | list acl-list}
Rtr1(config)#no ip audit signature signature-id

This command was introduced in IOS 12.0(5)T. The default is that no policy is attached to a signature.