How to monitoring IPS event logs !

Hi ,
We have Some Cisco IPS and also juniper IDP sensors in our networks ,with juniper i use NSM for analyzing network logs,attacks,generating different kind of graphs and stuff like that,its so easy to work with and also its informative, but with cisco IPS devices i dont know what tools are available for online monitoring network logs, attacks and also generating graphs for my boss .I see IDM but it doesn't have the features that we need ,does any one know anything else for analyzing and monitoring logs ?
Warm regards,
Omid

IME (IPS Manager Express) provides more information and reporting tool than IDM, and it can support up to 10 IPS devices/modules.
Here is the URL for IME for your reference:
http://www.cisco.com/en/US/products/ps9610/index.html
Please check the system requirement for IME on the following release notes:
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5715/ps9610/data_sheet_c78-459033.html
Hope that helps.

Similar Messages

SQL Server monitoring error event log 4001

hello Experts ,
We have SCOM 2012 R2 environment ,I have installed SQL SERVER MPs 6.5.0.1 and installed SCOM agent on some of SQL Server. Some of the SQL Server are monitoring working properly not all SQL Server but getting error for some of SQL Server in event log
Event :4001
Management Group: SCOMMgtGroup. Script: Main Module: CPUUsagePercentDataSource.ps1 :
Computer Name = 'MHSSCOM01.memnet.org' WMI = 'ComputerManagement11' Service Name = 'MSSQLSERVER' SQL Instance Name = 'MSSQLSERVER'
Exception calling "Fill" with "1" argument(s): "The user does not have permission to perform this action."Error occured during CPU Usage for SQL Instances data source executing.
Computer:MHSSCOM01
Reason: Exception calling "Fill" with "1" argument(s): "The user does not have permission to perform this action."
also not getting Database information within the SQL Server instances for these SQL Server within "Instances Summary "
for resolution ,I have created a Run as account (windows)for SQL monitoring then associated it with Run as profile with SQL Server default account,Discovery account and Monitoring account and distribute it securely to each SQL Server health service object
.The run as account have added to local admin group on each SQL server.
How to resolved the event log error and how to get database information for all instances of sql server.
Thanks
RICHA

Hi,
It seems like that the action account that run the script does not have enough permissions on the monitored SQL server, I would like to suggest you follow the below link to check your runas account configuration:
http://blogs.technet.com/b/kevinholman/archive/2010/09/08/configuring-run-as-accounts-and-profiles-in-r2-a-sql-management-pack-example.aspx
And make sure the action account also have SQL admin account to the SQL server.
Here is also a link that may be helpful for you:
http://blogs.technet.com/b/momteam/archive/2014/05/12/kb-event-4001-in-the-operations-manager-log-during-sql-server-2012-monitoring.aspx
Regards,
Yan Li
Regards, Yan Li

VB Scripting to monitor application event log based on specific words.

Hi All,
I Have written, vb script to monitor application event log based on specific word in the message. when I have included same script in monitor, after running this script at specific time once in day, I am getting run time error in the server, where it
supposed to run, could you please check the command where I have highlighted in below script.
Dim VarSize
Dim objMOMAPI
Dim objBag
Set objMOMAPI = CreateObject("MOM.ScriptAPI")
Set objBag = objMOMAPI.CreateTypedPropertyBag(StateDataType)
Set objFSO = CreateObject("Scripting.FileSystemObject")
Const CONVERT_TO_LOCAL_TIME = True
Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
dtmStartDate.SetVarDate dateadd("n", -1440, now)' CONVERT_TO_LOCAL_TIME
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'Application' AND " _
& "EventCode = '100'")
For Each objEvent in colLoggedEvents
If InStr(LCase(colLoggedEvents.Message), "Message :Application A3 has been successfully processed for today") Then
X= "Success"
end if
Next
if X="Success" then
call objBag.AddValue("State","GOOD")
call objMOMAPI.Return(objBag)
wscript.quit()
Else
call objBag.AddValue("State","BAD")
call objMOMAPI.Return(objBag)
wscript.quit()
End If

By programming standards since as long as I can remember the use of the value of a variable to detect its Boolean state has been used.
Cast your mind back to strongly typed languages, e.g. Pascal.
I'll cast back to the very early days of the "C" language where all variables could be treated as "bool" without a cast. The is no more strongly type language than "C". "C" practically invented the standards for all modern languages.
When I was writin machine language we also used zero as false but many machines only tested the high bit for truthieness. The HP machines and Intel allowed a test to aggregate to the sign bit. Adding that flag to the test alloed tru for
an numeric value that was non-zero. A boool test was also used for a negative e switch. If you study micro language implementation you will find that this hardware design and the companion compiler design is ... well... by design. It is a
way of improving the completeness and usefulness of an instruction set.
Other langauges may require further decoration due to some mistaken desire to be better than perfect. That is like trying to change number theory by renaming addition to be "gunking" and forcing everyone to use multiplication when adding the same number
more than once. A Boolean test os a test of the flag bit with to without aggregation. Even if we test a bit in a word we still mask and aggregate. It is always the most primitive operation. It is also the most useful
operation when you finally realize that it is like an identity in math.
Use the language features that are designed in. They can help to make code much more flexible and logical.
By the way, Pascal also treats everything as Boolean when asked to.
¯\_(ツ)_/¯

Correlating Cisco ASA-SSM-IPS Events/Logs

I have just configured a Cisco ASA-SSM-IPS10. An exciting feature of this decice is the ability to monitor, analyse, and correlate security events. Can anybody help with a documentation to simplify daily (or periodic) analysis, and correlation of the IPS Logs? As I am not yet to up to speed with this task yet, a "How-to" document would be just fine. Thank you.

Hi Chris,
Good to have you get on the case. I am yet to setup and ips manager software. Presently, I use an ASDM 6 interface, with this interface, I am able to view events and alerts, and perform other adminsitrative cores... The IPS manager express does it comes bundle with our device purchase? Does it contain necesary templates/docs for correlating events/Logs?

IPS event log size

Hi everyone,
I have a very "interesting" que from my customer.
He is asking me how much disk space is needed for an event log. Just one event log. Because I told him that IPS itself has limited space for logs and to archive it, please use IME installed on a server.
Does anyone know how much disk space is taken up for a single event log? LOL
Regards

There is no fixed size. Different types of events will contain more or less data. If you turn on packet captures, the size will be much larger as well.
- Bob

How to recover cleared event logs in windows server 2003 ?

Hi All,
i accidentally cleared all of event logs in my server, is there any solution or other thing that can recover it ?
thank you
Best Regard, Lim Siaw Liang

pray hard that there will be no issues, and no one will look for the event logs.
Once it's cleared, and that's it.
Or if you have system restore checkpoints try it, shadow copy on your c drive could do something also.
Every second counts..make use of it. Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
IT Stuff Quick Bytes

Does anybody know how to export the events log from a IPS 4260 ?

My company has a Cisco IPS 4260 and we used to get the log from the Cisco Security Manager but since July the software failed and now (December) I need to get / export the log from July to December that I think it is saved into the IPS. Is it possible? Does anybody know the command to see the saved log or the commands or procedure to export the log into a TFTP or FTP ?
I'll really appreciate your help, thanks.

No; That cannot be done. Only through a SDEE server.
Events are stored on a hard drive that the IPS has, if it has not been reloaded they should be there with no issues.
Get the application "IME". If I am not mistaken, you would be able to see those events there and I think there is a way to export them from there.
Mike Rojas

How to improve the event log read performance under intensive event writing

We are collecting etw events from customer machines. In our perf test, the event read rate can reach 5000/sec when there is no heavy event writing. However, the customer machine has very intensive event writing and our read rate dropped a lot (to 300/sec).
I understand there is IO bound since event write and read will race for the log file, which is also confirmed by the fact that whenever there is a burst of event write, a dip of event read happens at the same time. Therefore, the event read cannot catch up
the event write and the customer gets lagging behind logs.
Note that most of the events are security events generated by windows (instead of customers).
Is there a way to improve the event read performance under intensive event write? I know it is a hard question given the theory blocker just mentioned. But we will lose customers if there is no solution. Appreciate any clue very much!

Hi Leonjl,
Thank you for posting on MSDN forum.
I am trying to invite someone who familiar with this to come into this thread.
Regards,
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

How to monitor Calendar Events

Please Consider the scenario.
I have delegated two users to manage my calendar. Those users obviously have full rights on my calendar. I found out that an event that i created was deleted, and both of the shared calendar users denied that they have done.
How would i know who has deleted an event/task?
How would i know who has created an event /task?
Please help the user is getting furious
regards
Kimi

Hi,
You may want to have a look at the following calendar options (ics.conf):
caldb.berkeleydb.ensmsg.advancedtopics
caldb.berkeleydb.ensmsg.createevent
caldb.berkeleydb.ensmsg.deleteevent
caldb.berkeleydb.ensmsg.modifyevent
caldb.berkeleydb.ensmsg.refreshevent
These control the global notification of additional events to calendar entries. If users don't want to see these events they can turn notification emails off.
Shane.

How to monitor IPS sensor heath by emails?

Hi All,
Is there any way to configure e-mail notifications about IPS sensor health monitoring results?
I have tried to install IPS supported MIBs to my SNMP management station (actually, it is HP SIM). Cisco supported MIBs have not been installed successfully to HP SIM yet.
Also, I have been searching such a monitoring tool over cisco.com web site. And tools like LAN Monitoring Solution (or Device Fault Manager) requires licensing, so in my case it is not suitable.
Does somebody know SNMP management station (monitoring) tool which could monitor the sensor health without additional MIB installation?
There is one more practical question: Is there any way to send a test trap from IPS sensor to SNMP management station?
Thanks in advance,
Maksim

Hello Maksim,
This functionality is not yet available, but will be included in IPS 7.1. This enhancement is being tracked via CSCsu08529.
Thank you,
Blayne Dreier
Cisco TAC IDS Team
**Please check out our Podcast**
TAC Security Show: http://www.cisco.com/go/tacsecuritypodcast

How do "you" monitor event logs in SCOM 2012? Need opinions.

Fairly new to SCOM. Do you monitor all event logs? Just warnings and critical? How do you filter out things you don't want to see?
Looking for opinions here not just a "how-to".
Thanks,

Steps in creating a Event based Alerting Rule.
1. Open the Operations Manager Console.
2. Go to Authoring.
3. Under Authoring - Management Pack Objects - Select Rules
4. Right click on Rules and select - Create a new rule
5. Select Alert Generating Rules - Event Based - NT Event Log (Alert)
6. On the same screen select your destination management pack and click Next
7. Give a name to your Rule and optionally give it a Description.
8. Rule Category can be anything you like.
9. Select the Rule Target as the class of your choice, normally it can be Windows Computer.
10. Make sure the Rule is Enabled and select Next.
11. Select the Event log name from where event will be monitored and click Next. (for example Application or System
or Security)
12. Build the Expression to filter the events with the below details:
     a. Parameter Name = Event ID, Operator = Equals and Value = (any event id of your choice)
     b. Parameter Name = Event Source, Operator = Equals and Value = (any source of your choice) (you
may delete this filter if you want)
     c. Click on Insert button at Top and it will put the cursor at Parameter Name, click square button
with 3 dots [...] and it will popup another screen.
     d. In that box, select the 3rd radio button named 'Use parameter name not specified above' and there
manually type 'EventDescription' (without quotes) and click OK.
     e. Then come back to filter screen, now here you will see Parameter Name = EventDescription, and
for Operator select Contains and then for Value you can type any word you want to key on from the Event description.
13. After building the desired Expression, click Next.
14. Configure Alerts as you like and click the Create button.
To get the Alerting event details. Go to Start menu and in Run window type eventvwr.
And put the details on the wizard as per the below screenshot.
Refer: http://blogs.technet.com/b/operationsmgr/archive/2008/11/12/opsmgr-2007-how-to-create-an-alert-rule-based-on-an-event-description.aspx
Gautam.75801

Continuous "36888 Schannel Errors" in System Event Log when NOT connected to Internet

We are hoping someone will be able to assist with us this very strange issue please ?
We are using Windows 8.1 x64 Enterprise with Office 2013 and the latest Symantec Endpoint Proctecion v12.1.5 installed. They are managed using SCCM2012 in a large AD domain environment
When our workstations are NOT connected to the internet (only local intranet) the following errors appear in SYSTEM event log almost continuously (several times a minute).
Event ID:36888 User: SYSTEM OpCode:Info Level:Error Source:SChannel
"A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 70. The Windows Schannel error state is 11."
The process associated with these events is "Local Security Authority Process"
When an internet connection is enabled for these machines these 36888 errors will suddenly stop !.
An event "Error 36887 "A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 40." Is also occurring on these machines but only occasionally.
As a result, We suspect there must be a process continuously attempting to connect to an internet service and failing ?.
Some of the things we have tried so far;
- We have disabled all non-essential services (e.g. Windows Store Service) one by one but this didn't fix.
- We have tried disabling Tile updates on Start
- We have tried a bunch of different Group Policy settings to disable different combinations of TLS/SSL in IE config.
- We have searched the internet forums and tried some suggested fixes but this combination of error state and error code seems unique ?.
It doesn't happen on our Windows 7 x64 workstations that have much same apps & configuration.
Any advice or suggestions would be greatly appreciated !
Thanks.

Hi Makes006,
This Event ID 36888 occurs if a user tries to access a web site using HTTP but specifies an SSL port in the URL.
We can try clean boot to troubleshoot whether this issue is caused by a third party program .
How to perform a clean boot in Windows
http://support.microsoft.com/kb/929135
If there is no sensible impacts on operating the machines ,we can try to disable this log by modify the following registry key value to 0.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\EventLogging
For more information, please refer to the following link:
How to enable Schannel event logging in IIS
http://support.microsoft.com/kb/260729
Regards,
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Monitor Integration process log in BPM

Hi
I am practising the following BPM
/people/krishna.moorthyp/blog/2005/06/09/walkthrough-with-bpm
and I wanted to know how to monitor integration process log in BPM.
To monitor Integration process I logged, into transaction SXMB_MONI_BPE ->Process Selection->Selected corresponding integration process (in Service Field) - and Clicked Execute as suggested in the blog
But I get the message work item doesn't exist ??
What do I need to do in this case ??
Thanks,
Kiran

SAKHARDANDE ,
Go to sxmb_moni-->Monitor for processed xml message --> In the view box there is standard and process. Select Process for checking the messages of BPM.
Else as in the weblog mentioned go to SXMB_MONI_BPE ->Process Selection->Select corresponding integration process (in Service Field) ->Execute->Select work item. Select your service which you have used in ID.
If you dont find anything then first see whether you see your message in sxmb_moni or not? If not then check your file sender communicaiton channel in adapter monitoring.
Regards,
---Satish

Event Log Question re: changing security timeout

I believe someone may have changed my security timeout time from 2 minutes to 30 minutes and changed "require password for new apps" from yes to no. I know the approximate time when this occured but am overwhelmed by the volume of entries and the nomenclature. Is there something specific I could look for to confirm or refute my suspicion? Is there a "layman's" way to download the log without having developer tools?
Thanks

Hey raindogbc,
You can extract the device logs as outlined in this article: How to extract the event logs on a BlackBerry smartphone http://btsc.webapps.blackberry.com/btsc/KB05349.
Depending on what the logging was set to when this happened and when it happened you may not be able to find this information.
-HB
Come follow your BlackBerry Technical Team on twitter! @BlackBerryHelp
Be sure to click Kudos! for those who have helped you.Click Solution? for posts that have solved your issue(s)!

Monitor wait events thru OEM

Hi,
We have OEM (10.2.0.5) and how to monitor wait events thru OEM and where do we find them? I checked under performance tab and couldn't find.

Go to: Database Instance > Server Tab > Statistics Management > Automatic Workload Repository
Click "Run AWR Report" for any time period you want. It looks like Statspack report and has all the wait events in that period.
Another way is to Go to Performance Tab > Top Activity and click on a session in Top Sessions. It has a summary of waits for that session. You can change the drop down "Show Aggregated Data" to "Show Raw Data" to see breakdown of waits for the session.

How to monitoring IPS event logs !

Similar Messages

Maybe you are looking for