Log save

Unanswered Question
May 31st, 2010

Hi ,

I want to know how to save IPS 4260 logs.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Scott Fringer Tue, 06/01/2010 - 03:38

Cisco's IPS sensors allow event retrieval via the Security Device Event Exchange (SDEE) protocol.  There are many products that support this protocol.  Cisco provides a free solution called IPS Manager Express (IME).  It will retrieve signature events from Cisco IPS sensors and store them in a local MySQL database.  You can find out more about IME, and download it here:


Another solution, for multiple security device log collection and incident correlation, is CS-MARS.  You can find out more about CS-MARS here:



Munaf Ahmed Tue, 06/01/2010 - 23:54


Is there any product/tool avialable that our customer can use to pull IPS alarms/event logs via SDEE and save it on a syslog server (kiwi for example) ?



Scott Fringer Wed, 06/02/2010 - 03:28


  I am not aware of such a product.  I have heard of customers using perl scripts, and other custom solutions, to accomplish similar IPS event manipulation.


Munaf Ahmed Wed, 06/02/2010 - 05:06

I did some research, Security Information & Event Management (SIEM) solution provides log management capabilities for Cisco IPS and CS-MARS. Sansage SIEM supports SDEE protocol and it can pull data from Cisco IPS and CS-MARS.

/* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi;}




This Discussion