Cisco Systems IPS4510K9 manual IP Logging Notes and Caveats, 12-1

C H A P T E R 12

Configuring IP Logging

This chapter describes how to configure IP logging on the sensor. It contains the following sections:

•Understanding IP Logging, page 12-2

•Configuring Automatic IP Logging, page 12-2

•Configuring Manual IP Logging for a Specific IP Address, page 12-3

•Displaying the Contents of IP Logs, page 12-5

•Stopping Active IP Logs, page 12-6

•Copying IP Log Files to Be Viewed, page 12-7

IP Logging Notes and Caveats

The following notes and caveats apply to IP logging:

•Enabling IP logging slows down system performance.

•IP logging allows a maximum limit of 20 concurrent IP log files. Once the limit of 20 is reached, you receive the following message in main.log: Cid/W errWarnIpLogProcessor::addIpLog: Ran

out of file descriptors.

•You cannot delete or manage IP log files. The no iplog command does not delete IP logs, it only stops more packets from being recorded for that IP log. IP logs are stored in a circular buffer that is never filled because new IP logs overwrite old ones.

•You can configure IP logging restrictions using the permit-packet-logging true false command.

•On IPS sensors with multiple processors, packets may be captured out of order in the IP logs and by the packet command. Because the packets are not processed using a single processor, the packets can become out of sync when received from multiple processors.

For More Information

For detailed information about the packet-related command restrictions, see Configuring Packet Command Restriction, page 3-26.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		12-1