CHAPT ER
12-1
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
12
Configuring IP Logging
This chapter describes how to configure IP logging on the sensor. It contains the following sections:
•
Understanding IP Logging, page 12-2
•
Configuring Automatic IP Logging, page 12-2
•
Configuring Manual IP Logging for a Specific IP Address, page 12-3
•
Displaying the Contents of IP Logs, page 12-5
•
Stopping Active IP Logs, page 12-6
•
Copying IP Log Files to Be Viewed, page 12-7

IP Logging Notes and Caveats

The following notes and caveats apply to IP logging:
•
Enabling IP logging slows down system performance.
•
IP logging allows a maximum limit of 20 concurrent IP log files. Once the limit of 20 is reached,
you receive the following message in main.log:
Cid/W errWarnIpLogProcessor::addIpLog: Ran
out of file descriptors
.
•
You cannot delete or manage IP log files. The no iplog command does not delete IP logs, it only
stops more packets from being recorded for that IP log. IP logs are stored in a circular buffer that is
never filled because new IP logs overwrite old ones.
•
You can configure IP logging restrictions using the permit-packet-logging true | false command.
•
On IPS sensors with multiple processors, packets may be captured out of order in the IP logs and by
the packet command. Because the packets are not processed using a single processor, the packets
can become out of sync when received from multiple processors.
For More Information
For detailed information about the packet-related command restrictions, see Configuring Packet
Command Restriction, page 3-26.