IPS log and monitoring

Hi, All
Few Queries on Cisco IPS.!!!!
1. Which are best tool for fetching cisco IPS logs??
2. Where or Which directory Cisco Logs/Events are saved?
3. I am only able to see today log but not able to view past any logs? what are possible cause?
4. Any free-ware tool that fetch logs and events from cisco IPS?
5. Cisco IPS express manager is free-ware or we need only cisco customer account?
For any type of help.. Thanks
Jignesh

1. You can use IME (IPS Manager Express) to view all your IPS events.
Here is the IME page for your reference:
http://www.cisco.com/en/US/products/ps9610/index.html
2. The logs on the IPS device itself has very small storage space and it wraps once the log is full, therefore if you have a lot of events triggered, you are only able to see the latest events.
3. As per my above description.
4. Cisco IME - it's free (no extra license is required to use IME).
5. As long as you have CCO account, you should be able to download the IME software.
Hope this helps.

Similar Messages

Error handling, logging and monitoring business process

I would like to know more about error handling, logging and monitoring in business process? Can someone give more information on this one?

Chandran
Please refer to following tutorials to understand each of these topics in detail:
Validations:
http://www.orafmwschool.com/validations/
Exception Handling:
http://www.orafmwschool.com/exception-handling/
Fault Management Tutorial:
http://www.orafmwschool.com/fault-management-tutorial/
Business Activity Monitoring Tutorial:
http://www.orafmwschool.com/bam-tutorial/
You'll have to refer to Oracle documentation to understand more finer details.
-Amjad.

SUPER user logging and Monitoring

Since SAP does not recommend using GRC Access Control to log actions performed using SUPER users such as SAP, DDIC, or other powerful id's, what tools are available? When SAP, DDIC, or other powerful super users are used in your SAP environment. Are these activities being logged? Is anyone monitoring these activities? Do you even use SUPER id's in your environment or assign access directly to your BASIS team? Have you used GRC SPM or Virsa Firefighter to manage these users? Are you using monitoring tools such as Cyber-Ark to log and monitor your BASIS team? How do you ensure your management or audit team that all activities perfomed by SAP*, DDIC or other powerful SUPER users is logged and available for review?

> Since SAP does not recommend using GRC Access Control to log actions performed using SUPER users such as SAP*, DDIC, or other powerful id's, what tools are available?
Can you reference the source where SAP says that standard super users should not be logged?
SAP also says that standard users such as DDIC and SAP* are known targets of attack vectors(DoS attacks, password brute forcing, DB vulnerabilities...) so once having locked them down (see the other responses) it would make sense to monitor them for any events.
Cheers,
Julius

IDS/IPS logging, and SDM replacement?

I'm reviewing for my CCNA Security exam. I've got several books that I'm using for study materials..the Cisco press blue softcover, CCNA Security Study Guide by Tim Broyles...
Now, I've seen arguments about how the IDS "pulls" data. The books are unclear, and I'm trying to get a definitive answer.
In the IDS chapter in Cisco's book, discussion at the end of the chapter talks about how the IDS uses SDEE to pull the data. But it shows two examples of config lines, SDEE and Log, and it goes on to say that SDEE and Syslog are the protocols used to grab the alerts. But then, in the next paragraph, it says to that it uses HTTP (and further says HTTPS is more secure) to gather the data.
So, in googling to try and find resolution, I made the water murkier. I saw everything from those dreaded " I just took the exam..." and various other answers.
I'm thinking that syslog is not a protocol. Syslog is a venue where data is stored and can be retrieved and viewed by various applications like Solar Winds, etc. So, I'm thinking SDEE uses HTTPS (which is a protocol) to grab the data. But, I want to ensure I have my ducks in a row before the exam.
So, can someone with AUTHORITY please advise what the heck IDS uses to pull the data?
Now the 2nd part of this concerns dreaded SDM. SDM is at v 2.5, and there have been no updates/tweaks to it. I never see anyone in the RW use it. I'm sure that there's something better out there, yet Cisco is insisting on hammering that home on their CCNA security exam. What is SDM being replaced with? What should I start working with if I want to go on and get my CCNP Security certification?
Thanks much...testing on Tuesday

The confusion you are seeing is because IPS (or IDS) exists on two entirely different platforms; the router IOS and the IPS sensor appliance. These two types of IPS devices are managed and report events very differently.
The Router IOS PS feature can report events (signature hits) via syslog (and yes, that is a real protocol, just not a very secure one for carrying sensitive information like signature events) and SDEE. The Appliance IPS Sensors can only report events via SDEE (and SNMP Traps, if optioned on a per-signature basis to do so).
SDEE is a "pull" protocol, meaning the Sensor acts as the host and the client "asks" for signature events. This allows multiple clients to get a feed off one sensor and not have to maintain message synchronization. SDEE is an XML formatted protocol (so it's self documenting) and is carried over HTTPS.
- Bob

I am using fieldpoint and labview to log and monitor the temperatures of my system. but i am not using Labview 6i with DSC, how can i do it??

i am using fieldpoint 2.0 and labview 6i to monitor my system, but i think i don't have labview DSC.

I have written a relatively large Fieldpoint application "just" using LV5.1 FDS, so it can be done.
Fieldpoint can be seen as an external instrument, so you need to use the driver/vi's that comes with FP.
I believe using DSC would only make the job easier for you.

Decoding IPS logs

Hi,
Need guidance on decoding IPS syslogs(alerts). We monitor IPS logs and there we could see some decoded messages appearing for cid.context.cid:fromTarget, cid.context.cid.fromAttacket, cid.triggerPacket fields. Would like to understand what these fields are, how to decode these messages (any tools/url for decoding), why cisco has made these contents to appear decoded (any specific reason), how this will help us in analyzing such alerts.
Thanks!
-Jag.

Please use the below guide for message fields
http://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/cli/cliguide7/cli_packets.html

Deleting a request in ODS that has no request number and monitor log

Hai All,
I have a request that failed. It oesn't even have a request id and is not getting deleted. Even if I delete it, the trash can symbol appears onits side and then disappears but the request still satys. I changed the status to red and deleted. Still its not getting deleted. There is no log in monitor also. I have a lot of data in the ODS and cannot afford to delete all data and load. Is there any table in SAP where I cn go in and delete it or is there any other way around?

Hello BI,
Please check the job logs in SM37 and see what job log says for deleting ODS request at the end though the job finished successfully. See if the job is still running in SM51 at the backend on server. If so please stop that job. I doubt that the request is still running either in R3 or BW in the backend. That could be one reason why it sometimes doesnt allow the request to be deleted.
Hope this helps,
Bye,
Naga.
Message was edited by: Naga Timmaraju

Firstly hello to all. I'm looking to create a vi that will take a single logged output from a thermocouple and monitor the temperature and produce a Boolean when the temperature has stabilised for a pre determined time say 1minuet.

Firstly hello to all. I’m looking to create a vi that will
take a single logged output from a thermocouple and monitor the temperature and
produce a Boolean when the temperature has stabilised for a pre determined time
say 1minuet. I have managed to find a couple of examples on the forum but one
will only run on V8.2 and I have V8, the other is for more than one channel
witch is fine I can always reduce this, but it was the timing feature I was
having difficulty with. I looking to monitor the temperature of a motor until
it has stabilised prior to testing and then to use this temperature as a
reference. Pleas forgive my ignorance if this is a very simple thing but I’ am
learning and really enjoying it. Thank you in advance for your answers.

Hi
Graham, thank you for you reply.
What I’ am trying to achieve is a vi I can use in a motor
testing setup, a part of this would be to warm the motor up until the exhaust
air temperature has stabilised, this takes approximately 10 minuets. I was
thinking of just letting the motor run for this time and leave it at this, but
some motors warm up quicker that others and. I am basically looking for a vi with
an adjustable temperature window of say ±5 C° in 1° increments, timing wise 1minuet
to 10min the adjustment is so I a can use this for another application. I tried
to adjust the code I found at the link below but had a little difficulty with
the timing. Thank you so much for your help it’s much appreciated.
sine.ni.com/niforum/niforum?forumDU=http://forums.ni.com/ni/board/message?board.id=170&message.id=251017&requireLogin=False

Log and Transfer: The right half page with preview monitor disappears

Hello
With Log and Transfer, we have a windows likes a page which is divided into 2 spaces :
The left half space and the right half space.
Normally :
On the left half space we have, from left to right
Name / Volume / Media Start / Media Duration
On the right half space we have, from up to down, we have :
- The preview monitor
- Logging Import Settings
Name Preset
Reel
Clip name
Scene
Shot/Take
Angle
Log note
My problem is : When I tried to make wider one colum of the left half space, the right half space included the preview monitor vanishes
Thank you for help
Nhan

It is easier to show you than tell you - see if this helps:
https://vimeo.com/50334926
MtD

Understanding IPS log (sig:16297-Worm Activity)

Hi,
We are monitoring intrusions for a customer using SIEM and we got an alert based on the below IPS logs.
It would be great if someone helps clarify my doubts in analyzing this and similar IPS logs.
*********** Cisco IDS 08 Oct 2012 08:50:36 id= xyxyxyxyxyxyxyxyxyx sig_id= 16297 sig= Worm Activity - Brute Force src= 10.10.10.4 src_port= [3539] dst= 192.168.178.131 dst_port= [445] sev= informational proto= tcp eventId=1340445327004327804 severity=informational vendor=Cisco sd:originator.sd:hostId=AIP-SSM-1 sd:originator.cid:appName=sensorApp sd:originator.cid:appInstanceId=462 sd:time.offset=XYZ sd:time.timeZone=XYZ sd:time=1349686236842887000 sd:signature.cid:created=20090331 sd:signature.cid:type=anomaly sd:signature.cid:version=S392 sd:signature.description=Worm Activity - Brute Force sd:signature.id=16297 sd:signature.cid:subsigId=0 sd:signature.cid:sigDetails=Multiple logon failures sd:signature.marsCategory=Propagate/Worm sd:interfaceGroup=vs0 sd:vlan=0 sd:participants.sd:attacker.sd:addr.cid:locality=OUT sd:participants.sd:attacker.sd:addr=10.10.10.4 sd:participants.sd:attacker.sd:port=3539 sd:participants.sd:target.sd:addr.cid:locality=OUT sd:participants.sd:target.sd:addr=192.168.178.131 sd:participants.sd:target.sd:port=445 sd:participants.sd:target.cid:os.idSource=learned sd:participants.sd:target.cid:os.relevance=relevant sd:participants.sd:target.cid:os.type=windows-nt-2k-xp sd:participants.sd:target.cid:os= cid:context.cid:fromTarget= <removed> cid:context.cid:fromAttacker=<removed> cid:alertDetails=InterfaceAttributes: context="single_vf" physical="Unknown" backplane="GigabitEthernet0/1" ; cid:triggerPacket=<removed> cid:riskRatingValue.attackRelevanceRating=relevant cid:riskRatingValue.targetValueRating=medium cid:riskRatingValue=25 cid:threatRatingValue=25 cid:interface.backplane=GigabitEthernet0/1 cid:interface.context=single_vf cid:interface.physical=Unknown cid:interface=GigabitEthernet0/1 cid:protocol=tcp ************
1. I checked for sig:16297 via ASDM demo version, but didn't found this signature in sig0. Where can we see this signature settings and properties.
2. The fields "cid:context.cid:fromTarget=", "cid:context.cid:fromAttacker=", & "cid:triggerPacket=" looks to be like encoded format. How to decode this, any tools/URL? How these fields are significant
3. If this is false postivie (based on src/dst and activity), how to fine tune this in IPS?
Note: I don't have access to this IPS. But, I need to coach the owner for fine tuning and for other checks.
Thanks!
-Jag.

Hi Jag.
Here is a link with more information on alert 16297/0.
tools.cisco.com/security/center/viewIpsSignature.x?signatureId=16297&signatureSubId=1&softwareVersion=6.0&releaseVersion=S392
Generally on that signature I'd email the customer and ask them to check the attacker IP to ensure that the computer doesn't have a virus. If these end up coming in frequently and the customer comes back stating they are false alerts then you may need to filter the alert or just send a report to the customer once a week with the IPs in question from the alert.
As far as decoding the fields in question 2, that comes out in base64. We have a powershell script that decodes these fields. I have tried various Web based decoders with mixed success which is why we wrote a powershell script to do the job.

IPS Log geneate in VMS

Hi
I have VMS which management and monitoring IPS. 3 IPS added in VMS. a lot of log generate from IPS to VMS. I want to reduce the log. so how I can do
that.
thanks
Biplob

NMSROOT/bin/logrot.pl can do this. See the online documentation on how to configure it, but essentially you run NMSROOT/bin/perl NMSROOT/bin/logrot.pl -c and follow the menu prompts.
Good Luck,
-Joe R.

No Audio during Log and Capture

Hello, I have FCP 6.0 and am unable to hear my audio during log and capture. I have this problem on all 5 G5 Macs that I have, and have tried different editing docks and cables. I have used FCP for more than 5 years and have never had this problem. iMovie has audio during capture, so I am convinced that there is a pre-set in FCP that I don't have checked properly, but I've been over them many times and still have no answer. I searched past forums and didn't really find anything helpful to me.
My pre-sets are set to DV NTSC 48kHz and the playback pre-sets are set to default. I can hear audio of my clips after I log and capture, but I still need to hear audio during importing. I'm more confused than anything. If anybody has had this problem before or any suggestions for me, I'm all ears.
Thanks.
John

... as Bogie says.
However... this is a non-feature that dates back to slower CPU days... yet, still with all the different formats and such I (ME!!) I believe it's still good practice to leave it off.
Devoting as much CPU work to the capture process lessens the chance for something to go wrong. You can easily monitor the audio directly out of the deck as needed.
Sure -- octo cores need 30 apps open just to get your money's worth and I'm sure you won't have any issues using an 8th of one to send audio thru itself while the other 7 and 7/8ths are used for capture... but who wants to risk it?
Not me... I'm to old to change my ways.
Blast you FCP v1.2.5 on a beige G3 with 7gig and 15gig hard drive -- you taught me well.
CaptM

Preview disabled in log and capture

I am using Final Cut Pro 7 on the latest iMac i7.
I have a DVCam deck connected to the iMac via a firwire 800 cable.
There is a DV tape with DV footage in the deck.
I am able to control the deck from log and capture but the display is the colour bar window with PREVIEW DISABLED on it.
I have checked and double checked that my settings are correct, that video and audio are selected in capture settings etc etc.
Everything is selected correctly on the deck.
All mu suer preferences and presets are also correct.
I have trashed FCP preferences as well.
The content on the tape is viewable fine on the camera and on an external monitor.
So, in summary:
I am unable to log and capture DV material from the tape even though the deck is controllable from log and capture window.

It's a Sony DVCam DSR 11 deck which will play mini DV or DvCam tapes recorded in PAL or NTSC.
I haven't changed anything on the deck at all since last usung it a few weeks ago with the G5 and Tiger OS. I simply unplugged the firewire and plugged it straight into the new iMac.
The old G5 was running FCP6, but because the G5 and Tiger (it's was a pre Intel machine) won't run FCP7 I decided to use this as the reason to upgrade and chage to the iMac i7 Lion OS.
The material in question is PAL DV on mini tapes.
The camera is a Panasonic DVX100A and only capapble of recording in SD DV.
All the selection switches are correct on the deck. I'm puzzled why I can get the image and capture from the camera, with the same cable, and yet not from the deck.
Thanks Michael

Audio lag from Canon XHA1 speaker during log and capture

Hey All,
I'm working with a Canon XHA1. I'm logging and capturing video shot in HDV (1920 by 1080) @ 60i, . I can see the video on screen but the audio playing back from the camera is about half a second behind what I'm seeing on screen.
My video monitor on the camera sincs up fine with the audio during this process AND my final capture is fine. It's just hard to work with this audio delay during the log and capture.
Is this a settings issue? I don't think I can monitor sound through the computer during log and capture, right?
Here are my settings:
Sequence preset:
HDV - 1080i60
Capture preset: HDV
Device control preset:
HDV Firewire Basic
Video Playback: None
Audio Playback: Default
Any suggestions?
AND can anybody tell me what Apple Intermediate Codec 1080i60 means?
PowerBook G4 Mac OS X (10.4.5)

Oh, and I neglected to mention I'm using a MacBook Pro running 10.4.10 and I'm running FCP 5.1.4
Thanks in advance.

Is it possible to resize the log and capture window?

Hi,
Using Final cut pro, I would like to make my capture window a bit bigger while capturing. I am capturing footage via my Blackmagic Infinity card and get the input through an HDMI cable. I'm capturing in Apple Pro ress on 720p, 59,59 fps.
For a good overview of what I'm capturing at the moment, I would love to have a bigger capture window. For all I know, FC pro doesn't support the resizing of the log and capture window. Anyone an idea on how to solve this?
Thank you.

In my case, the capture window is adjustable if I am capturing SD (DVCAM) video. I can also use the scopes in this case. (Good if you are recording to disk, or using a laptop for monitoring.)
However, both features (adjustable capture window and scopes) are not available if capturing HD (HDV in my case) video.
Message was edited by: amarasme

IPS log and monitoring

Similar Messages

Maybe you are looking for