Cisco IPS 7.1 Installation Guide Page 369
- Page / 422
- Table of contents
- TROUBLESHOOTING
- BOOKMARKS
Rated. / 5. Based on customer reviews
E-99
Cisco Intrusion Prevention System Appliance Hardware Installation Guide for IPS 7.1
OL-24002-01
Appendix E Troubleshooting
Gathering Information
• Displaying Events, page E-99
• Clearing Events, page E-102
Sensor Events
There are five types of events:
• evAlert—Intrusion detection alerts
• evError—Application errors
• evStatus—Status changes, such as an IP log being created
• evLogTransaction—Record of control transactions processed by each sensor application
• evShunRqst—Block requests
Events remain in the Event Store until they are overwritten by newer events.
Understanding the show events Command
The show events command is useful for troubleshooting event capture issues in which you are not seeing
events in Event Viewer or Security Monitor. You can use the show events command to determine which
events are being generated on the sensor to make sure events are being generated and that the fault lies
with the monitoring side.
You can clear all events from Event Store by using the clear events command.
Here are the parameters for the show events command:
sensor# show events
<cr>
alert Display local system alerts.
error Display error events.
hh:mm[:ss] Display start time.
log Display log events.
nac Display NAC shun events.
past Display events starting in the past specified time.
status Display status events.
| Output modifiers.
Displaying Events
Note The Event Store has a fixed size of 30 MB for all platforms.
Note Events are displayed as a live feed. To cancel the request, press Ctrl-C.
Use the show events [{alert [informational] [low] [medium] [high] [include-traits traits]
[exclude-traits traits] [min-threat-rating min-rr] [max-threat-rating max-rr] | error [warning]
[error] [fatal] | NAC | status}] [hh:mm:ss [month day [year]] | past hh:mm:ss] command to display
events from Event Store. Events are displayed beginning at the start time. If you do not specify a start
time, events are displayed beginning at the current time. If you do not specify an event type, all events
are displayed.
- Text Part Number: OL-24002-01 1
- CONTENTS 3
- B Initializing the Sensor B-1 7
- C Obtaining Software C-1 7
- E Troubleshooting E-1 9
- Contents 10
- OL-24002-01 10
- F Cable Pinouts F-1 12
- About This Guide 13
- Organization 14
- Conventions 14
- Related Documentation 15
- Submitting a Service Request 16
- Introducing the Sensor 17
- How the Sensor Functions 18
- Your Network Topology 19
- Tuning the IPS 19
- Sensor Interfaces 20
- Command and Control Interface 21
- Sensing Interfaces 22
- Interface Support 22
- TCP Reset Interfaces 27
- Interface Restrictions 28
- Interface Modes 30
- Figure 1-2 Promiscuous Mode 31
- • Monitor session 31
- Inline Interface Pair Mode 32
- Inline VLAN Pair Mode 32
- VLAN Group Mode 33
- Supported Sensors 34
- Table 1-4 Supported Sensors 35
- IPS Appliances 36
- Appliance Restrictions 37
- The Sensor and Time Sources 39
- Step 1 Log in to the sensor 40
- Time Sources and the Sensor 42
- Installation Preparation 43
- Safety Recommendations 44
- Safety Recommendations 45
- Working in an ESD Environment 46
- General Site Requirements 47
- Power Supply Considerations 48
- Configuring Equipment Racks 48
- Installing the IPS 4270-20 49
- Supported Interface Cards 52
- Hardware Bypass 53
- 4GE Bypass Interface Card 54
- • AC power present 60
- • Standby mode 60
- Diagnostic Panel 62
- Rail System Kit Contents 65
- < 28.5” 68
- For threaded-hole racks: 70
- Installing the IPS 4270-20 84
- Installing and Removing Fans 98
- Product Overview 102
- Specifications 102
- Specifications 103
- Accessories 104
- Front and Back Panel Features 105
- Rack Mount Installation 109
- Rack Mount Installation 110
- For More Information 111
- 11 2 3 4 117
- Installing DC Input Power 121
- Statement 122 123
- • Ground lead wire (middle) 124
- Figure 4-19 Ground Wires 124
- Chassis Features 131
- Cisco ASA 5585-X IPS SSP 132
- Cisco IPS 4520 132
- Chassis Features 135
- Memory Configurations 139
- Supported SFP/SFP+ Modules 139
- Table 5-7 SFP/SFP+ Modules 140
- SFP/SFP+ 141
- Package Contents 150
- Step 13 Power on the sensor 160
- Step 1 Power off the sensor 161
- Memory Specifications 168
- Indicators 169
- Removing the ASA 5500 AIP SSM 171
- Front Panel Features 176
- Memory Requirements 180
- SFP/SFP+ Modules 181
- Installing SFP/SFP+ Modules 183
- Logging In to the Sensor 189
- Logging In to the Appliance 190
- Logging In to the Sensor 196
- Initializing the Sensor 197
- Simplified Setup Mode 198
- System Configuration Dialog 198
- Use NTP?[no]: yes 199
- Basic Sensor Setup 200
- Advanced Setup 203
- Step 29 Reboot the appliance 208
- Verifying Initialization 221
- Verifying Initialization 223
- Obtaining Software 225
- IPS 7.1 Files 226
- IPS Software Versioning 227
- IPS-[sig]-[S]-req-E1.pkg 228
- IPS Software Release Examples 229
- Accessing IPS Documentation 231
- Understanding Licensing 232
- Installing the License Key 236
- Uninstalling the License Key 238
- Upgrading the Sensor 243
- Upgrade Notes and Caveats 244
- Manually Upgrading the Sensor 244
- Downgrading the Sensor 251
- Installing System Images 253
- TFTP Servers 254
- Installing System Images 270
- Troubleshooting 271
- Cisco Bug Search 272
- Preventive Maintenance 272
- Creating the Service Account 275
- Disaster Recovery 276
- Recovering the Password 277
- Using the GRUB Menu 278
- Using ROMMON 279
- Using the ASDM 281
- Disabling Password Recovery 283
- Time Sources and the Sensor 285
- The ASA IPS Modules 286
- Correcting Time on the Sensor 287
- Supported MIBs 288
- Troubleshooting the Appliance 292
- Analysis Engine is Busy 294
- Communication Problems 295
- Step 1 Log in to the CLI 298
- The SensorApp and Alerting 299
- Unable to See Alerts 302
- Check for alerts 303
- Sensor Not Seeing Packets 304
- Blocking 306
- Verifying ARC is Running 307
- Device Access Issues 310
- Enabling Debug Logging 315
- Step 11 View the zone names 316
- Zone Names 319
- Software Upgrades 322
- Issues With Automatic Update 323
- Troubleshooting the IDM 325
- Troubleshooting the IME 327
- Not Supported Error Message 328
- Installation Error 328
- Health and Status Information 329
- Failover Scenarios 331
- Configuration Examples 332
- IPS Reloading Messages 334
- • 1300.0 337
- • 1304.0 337
- • 1305.0 337
- IPS Not Loading 340
- Gathering Information 347
- Tech Support Information 348
- Varlog Files 349
- Tech Support Command Output 350
- Version Information 352
- Statistics Information 355
- Displaying Statistics 356
- Interfaces Information 367
- Events Information 368
- Sensor Events 369
- Displaying Events 369
- Clearing Events 372
- Gathering Information 374
- Cable Pinouts 375
- Console Port (RJ-45) 376
- RJ-45 to DB-9 or DB-25 377
- Appendix F Cable Pinouts 378
- RJ-45 to DB-9 or DB-25 378
- Numerals 379
- Glossary 380
- Numerics 405
Related products and manuals for Networking Cisco IPS 7.1
Networking Cisco SMTP User Manual
(3 pages)
(3 pages)
Networking Cisco 815 User Manual
(8 pages)
(8 pages)
Networking Cisco WRT54GC User's Guide
(83 pages)
(83 pages)
Networking Cisco uBR900 Series Specifications
(138 pages)
(138 pages)
Networking Cisco 828 Installation Guide
(10 pages)
(10 pages)
Networking Cisco CB20A User Manual
(6 pages)
(6 pages)
Networking Cisco AIR-PCM352 - Aironet 350 Series 11Mbps Wireless LAN PC Card Adapter User Manual
(7 pages)
(7 pages)
Networking Cisco 7300-6T3 Specifications
(54 pages)
(54 pages)
Networking Cisco uBR904 User Manual
(22 pages)
(22 pages)
Networking Cisco WAE-611-K9 User Manual
(44 pages)
(44 pages)
Networking Cisco CTX2500 User's Guide
(530 pages)
(530 pages)
Networking Cisco AG241 User's Guide
(41 pages)
(41 pages)
© 2020, manymanuals.com. All rights reserved. | 0.033 s |
Manymanuals.com
Manymanuals.de
Manymanuals.fr
Manymanuals.it
Manymanuals.pl
Manymanuals.cz
Manymanuals.es
Manymanuals-pt.com
Comments to this Manuals