Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Attention: The Cisco Support Community site will be in read only mode on Dec14, 2017 from 12:01am PST to 11:30am for standard maintenance. Sorry for the inconvenience.

New Member

How to see EPS (events per second) at IPS from CLI

Hi folks,

Is there anyway to see the number of EPS a particular IPS sensor generates while being connected to it via telnet?

What's the size of the events store? And how can SDEE pull old events from the store?

2 REPLIES
Gold

Re: How to see EPS (events per second) at IPS from CLI

You'll have to do a little math to come up with that number yourself:

"show stat analysis"

then take the output lines:

Number of seconds since service started = 10887

Number of SigEvents since reset = 37360

and devide the sigevent count by the number of seconds.

The event store is a fixed size (and I don't remember how big they made it in flash) but the events are variable in size. SDEE can be used to pull old events because the client (your SIM, MARS, etc) requests events from the server (your sensor) much like you do when querying the event store from the CLI.

"show event alerts past 23:39"

New Member

Re: How to see EPS (events per second) at IPS from CLI

Wow,

Never knew about such calculations. Thanks a lot!

Were these statistics from a busy IPS sensor? I don't seem to exceed 10 EPS and thought this is low. And I wouldn't think that calculating the size of every event is tricky?

Simply copying the details of every event into notepad gives me the size of every event about 1K.

580
Views
0
Helpful
2
Replies
CreatePlease to create content