Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

A bit confused on signatures

Hey all, after reading two PDFs on the CIDS setup and tinkering a bit, I'm slightly confused. I would like to write a short script to take the alerts generated by the IDS and pipe them to logger via cron every 5 minutes or so. The problem is I'm not sure where the alerts are being held. Are they the ones with names like "log.200209161909" (in /usr/nr/var)? If so then how do I get understandable output from them?

I'm sorry if this is a bit low-level, I'm really trying to grasp what is where on this sensor (a FreeBSD junkie stuck in Solarisville). Thanks for any help.

PS - If anyone has already written a text->logger script for this and is willing to post it I would appreciate it. :-)

2 REPLIES
Cisco Employee

Re: A bit confused on signatures

The logfile in /usr/nr/var is the current active log it is a memory mapped file and there fore will not be able to be used easily by your script. The files in the /usr/nr/var/new directory are the completed logs and are human readable, albeit they will be time delayed depending on how often your log files in /usr/nr/var are being turned over.

Cisco Employee

Re: A bit confused on signatures

The log files in /usr/nr/var/new are in a comma delimited format.

That format is described in the IDM Configuration Note:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids8/13876_01.htm#xtocid55

102
Views
0
Helpful
2
Replies