First, please take a look at http://www.cisco.com/en/US/products/ps6634/products_white_paper0900aecd805c4ea8.shtml.

In summary, the copy command follow the following process:

1. load signature from outside server

2. parse it and read into memory

3. save out to the directory configuration as the ips location, in normal cases, it would be the router flash.

When save the files out, it will save into multiple files in a compressed format, even it has a .xml extension, it is compressed.

Here are the files got saved out:

. -sigdef-typedef.xml

type definition files, defines the engine parameters etc.

. -sigdef-category.xml

signature category file. Just a mapping file map the category to signature IDs

. -sigdef-default.xml

Signature file. Contains all signatures and their parameter definitions

When management by CSM/SDM, it also will save out couple of other files:

. -sigdef-delta.xml

Contains all signature modification information other than the default in sigdef-default.xml

. -seap-delta.xml

Contains all the SEAP configuration changes

. -seap-typedef.xml

SEAP type definition file.

Thanks,

-Chris