Filter
Top Products
7-41
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Chapter 7 Configuring Event Action Rules
Monitoring Events
Step 5 Display alerts from the past 45 seconds.
sensor# show events alert past 00:00:45
evIdsAlert: eventId=1109695939102805307 severity=medium vendor=Cisco
originator:
hostId: sensor
appName: sensorApp
appInstanceId: 367
time: 2011/03/02 14:15:59 2011/03/02 14:15:59 UTC
signature: description=Nachi Worm ICMP Echo Request id=2156 version=S54
subsigId: 0
sigDetails: Nachi ICMP
interfaceGroup:
vlan: 0
participants:
attacker:
addr: locality=OUT 10.89.228.202
target:
addr: locality=OUT 10.89.150.185
riskRatingValue: 70
interface: fe0_1
protocol: icmp
evIdsAlert: eventId=1109695939102805308 severity=medium vendor=Cisco
originator:
--MORE--
Step 6 Display events that began 30 seconds in the past.
sensor# show events past 00:00:30
evStatus: eventId=1041526834774829055 vendor=Cisco
originator:
hostId: sensor
appName: mainApp
appInstanceId: 2215
time: 2011/01/08 02:41:00 2011/01/08 02:41:00 UTC
controlTransaction: command=getVersion successful=true
description: Control transaction response.
requestor:
user: cids
application:
hostId: 64.101.182.101
appName: -cidcli
appInstanceId: 2316
evStatus: eventId=1041526834774829056 vendor=Cisco
originator:
hostId: sensor
appName: login(pam_unix)
appInstanceId: 2315
time: 2011/01/08 02:41:00 2011/01/08 02:41:00 UTC
syslogMessage:
description: session opened for user cisco by cisco(uid=0)