Filter
Top Products
C-111
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Appendix C Troubleshooting
Gathering Information
appName: login(pam_unix)
appInstanceId: 2315
time: 2011/01/08 02:41:00 2011/01/08 02:41:00 UTC
syslogMessage:
description: session opened for user cisco by cisco(uid=0)
Clearing Events
Use the clear events command to clear the Event Store.
To clear events from the Event Store, follow these steps:
Step 1 Log in to the CLI using an account with administrator privileges.
Step 2 Clear the Event Store.
sensor# clear events
Warning: Executing this command will remove all events currently stored in the event
store.
Continue with clear? []:
Step 3 Enter yes to clear the events.
cidDump Script
If you do not have access to the IDM, the IME, or the CLI, you can run the underlying script cidDump
from the service account by logging in as root and running /usr/cids/idsRoot/bin/cidDump. The path of
the cidDump file is /usr/cids/idsRoot/htdocs/private/cidDump.html. cidDump is a script that captures a
large amount of information including the IPS processes list, log files, OS information, directory
listings, package information, and configuration files.
To run the cidDump script, follow these steps:
Step 1 Log in to the sensor service account.
Step 2 Su to root using the service account password.
Step 3 Enter the following command.
/usr/cids/idsRoot/bin/cidDump
Step 4 Enter the following command to compress the resulting /usr/cids/idsRoot/log/cidDump.html file.
gzip /usr/cids/idsRoot/log/cidDump.html
Step 5 Send the resulting HTML file to the TAC or the IPS developers in case of a problem.
For More Information
For the procedure for putting a file on the Cisco FTP site, see Uploading and Accessing Files on the
Cisco FTP Site, page C-112.