Directing Cidlog Messages To Syslog - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Troubleshooting the 4200 Series Appliance
3. The CIDS servlet interface is the interface layer between the CIDS web server and the

Directing cidLog Messages to SysLog

It might be useful to direct cidLog messages to syslog.
To direct cidLog messages to syslog, follow these steps:
Go to the idsRoot/etc/log.conf file.
Step 1
Make the following changes:
Step 2
a.
b.
Note
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
C-28
servlets.
Set [logApp]
enabled=false
Comment out the
enabled=true
Set [drain/main]
type=syslog
The following example shows the logging configuration file:
timemode=local
;timemode=utc
[logApp]
;enabled=true
;-------- FIFO parameters --------
fifoName=logAppFifo
fifoSizeInK=240
;-------- logApp zone and drain parameters --------
zoneAndDrainName=logApp
fileName=main.log
fileMaxSizeInK=500
[zone/Cid]
severity=warning
drain=main
[zone/IdsEventStore]
severity=debug
drain=main
[drain/main]
type=syslog
The syslog output is sent to the syslog facility local6 with the following correspondence to syslog
message priorities:
LOG_DEBUG, //
LOG_INFO,
LOG_WARNING, // warning
LOG_ERR, //
LOG_CRIT //
Make sure that your /etc/syslog.conf has that facility enabled at the proper priority.
because
enabled=false
debug
// timing
error
fatal
Appendix C
is the default.
Troubleshooting
78-16527-01