Events; Displaying Events - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Events

To have the CLI pause and display the --
Step 3
sensor# terminal length 10
Events
This section describes how to display and clear events from the Event Store, and contains the following
topics:
•
•

Displaying Events

Use the show events [{[alert [informational] [low] [medium] [high] [include-traits traits]
[exclude-traits traits]] | error [warning] [error] [fatal] | NAC | status}] [hh:mm:ss [month day [year]]
| past hh:mm:ss] command to display events from the Event Store.
Events are displayed beginning at the start time. If you do not specify a start time, events are displayed
beginning at the current time. If you do not specify an event type, all events are displayed.
Events are displayed as a live feed until you cancel the request by pressing Ctrl-C.
Note
The following options apply:
•
•
•
•
•
•
•
•
•
The show events command waits until a specified event is available. It continues to wait and display
Note
events until you exit by pressing Ctrl-C.
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
13-4
Displaying Events, page 13-4
Clearing Events from the Event Store, page 13-7
alert—Displays alerts. Provides notification of some suspicious activity that may indicate an attack
is in process or has been attempted.
If no level is selected (informational, low, medium, or high), all alert events are displayed.
include-traits—Displays alerts that have the specified traits.
exclude-traits—Does not display alerts that have the specified traits.
traits—Trait bit position in decimal (0 to 15).
error—Displays error events. Error events are generated by services when error conditions are
encountered.
NAC—Displays Network Access Controller (block) requests.
status—Displays status events.
past—Displays events starting in the past for the specified hours, minutes, and seconds.
hh:mm:ss—Hours, minutes, and seconds in the past to begin the display.
Chapter 13
prompt every 10 lines, use 10 for the screen length value:
more--
Administrative Tasks for the Sensor
78-16527-01