Jeff,

  I'll open a feature request to look into the possibility of including interface info from the messages received.  The problem could be if there are more than one interface.  For example, if a syslog message comes in stating MAC address A moved from interface gi-0/0 to gi-0/1.  I guess we could put the last interface into the issue. 

There is a column in the issue viewer 'messages' that may help.  While it does not solve a 'quick glance' solution, it does enable the user to view the exact message that triggered the issue from within the issue detail viewer.  There is a known issue when using FF 3.5+ where the filters to not get applied when launching the Event Viewer.  This results in loading the Event Viewer Home Page (sans filters) when clicking on the messages hyperlink.  You will need to use IE7/8 to see the filtered view.  This will show the actual message that triggered the issue, which would contain the interface. 

Also, if you are using real-time e-mail notifications this link will be included in the e-mail.

I'll also open a feature request to look into severity based off of interface groups.  That is a really good idea.  This could expand to device groups as well.

Thanks,
Shawn

The problem with the view message is if there are lots of messages, such as a storm control or port security message.  One that is triggered every few seconds.  You now how 30-300 messages to review.  If there were two interfaces on the same switch you would never find them.

Thank You

ahh ok, I see.  That would definitely be a painstaking task!  I'll add this scenario to the Feature Request.