IPS stop event data in event viewer

Unanswered Question
Jan 2nd, 2008


One of my IPS running well and viw event report in event viewer. but suddenly no event come in event viwer. at first i think corrupt the event viwer and install another pc but same result. My sensing interface up and management interface also up. when I excute show events 12:00:00 then event dispaly but when i excute only show events then no response. I already reboot it. but no result so what i take the step ?


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
mhellman Wed, 01/02/2008 - 07:15

you are right to start by troubleshooting directly on the appliance.

"show events" starts from the current time, so no events may not show up right away. try:

# show events alert past 01:00

this will show alarms for the past hour. if you normally receive lots of alarms in a given hour, this should tell you something.

If you don't see any alarms (and in a given hour you normally would),

use the "packet display" command to verify that you are seeing all the traffic you should be seeing. Are you actually inline?

iqbalkhan Thu, 01/03/2008 - 02:40


Its not inline. and when I give command packet display , then dispaly traffic.




This Discussion