Cisco Systems IPS4510K9 Monitoring Events

8-38
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter8 Configuring Event Action Rules
Monitoring Events
Name of current Event-Action-Rules instance = rules0
List of interfaces monitored by this virtual sensor = mypair
Denied Address Information
Number of Active Denied Attackers = 0
Number of Denied Attackers Inserted = 2
Number of Denied Attackers Total Hits = 287
Number of times max-denied-attackers limited creation of new entry = 0
Number of exec Clear commands during uptime = 1
Denied Attackers and hit count for each.
Step 10 Clear only the statistics.
sensor# show statistics virtual-sensor clear
Step 11 Verify that you have cleared the statistics. The statistics have all been cleared except for the Number of
Active Denied Attackers
and Number of exec Clear commands during uptime categories. It is
important to know if the list has been cleared.
sensor# show statistics virtual-sensor
Virtual Sensor Statistics
Statistics for Virtual Sensor vs0
Name of current Signature-Definition instance = sig0
Name of current Event-Action-Rules instance = rules0
List of interfaces monitored by this virtual sensor = mypair
Denied Address Information
Number of Active Denied Attackers = 2
Number of Denied Attackers Inserted = 0
Number of Denied Attackers Total Hits = 0
Number of times max-denied-attackers limited creation of new entry = 0
Number of exec Clear commands during uptime = 1
Denied Attackers and hit count for each.
10.20.2.5 = 0
10.20.5.2 = 0
Monitoring Events
This section describes how to display and clear events from the Event Store, and contains the following
topics:
• Displaying Events, page 8-38
• Clearing Events from Event Store, page 8-41
Displaying Events
Note The Event Store has a fixed size of 30 MB for all platforms.
Note Events are displayed as a live feed. To cancel the request, press Ctrl-C.