Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

A bit confused on signatures

Hey all, after reading two PDFs on the CIDS setup and tinkering a bit, I'm slightly confused. I would like to write a short script to take the alerts generated by the IDS and pipe them to logger via cron every 5 minutes or so. The problem is I'm not sure where the alerts are being held. Are they the ones with names like "log.200209161909" (in /usr/nr/var)? If so then how do I get understandable output from them?

I'm sorry if this is a bit low-level, I'm really trying to grasp what is where on this sensor (a FreeBSD junkie stuck in Solarisville). Thanks for any help.

PS - If anyone has already written a text->logger script for this and is willing to post it I would appreciate it. :-)

Cisco Employee

Re: A bit confused on signatures

The logfile in /usr/nr/var is the current active log it is a memory mapped file and there fore will not be able to be used easily by your script. The files in the /usr/nr/var/new directory are the completed logs and are human readable, albeit they will be time delayed depending on how often your log files in /usr/nr/var are being turned over.

Cisco Employee

Re: A bit confused on signatures

The log files in /usr/nr/var/new are in a comma delimited format.

That format is described in the IDM Configuration Note: