topic IPS logs in Network Security https://community.cisco.com/t5/network-security/ips-logs/m-p/1949211#M55257 <HTML><HEAD></HEAD><BODY><P>IPS logs are stored in the form of events. These events can be retrieved using SDEE (Security Device Event Subscription) from an external client. The event retrieval operations begin with a client initiating an unencrypted HTTP or an encrypted HTTP over TLS/SSL connection with the sensor over which event requests and responses will be communicated. Once a connection is established, the client may initiate requests to the sensor. The sensor acts on the requests and responds back to each of the client's requests with a response.</P><P>There is another type of logs called iplogs which are binary files captured on the interfaces. These can be directly copied off the sensor using "copy iplog" command.</P><P></P><P>Hope this helps.</P><P>Madhu</P></BODY></HTML> Wed, 16 May 2012 18:31:43 GMT mkodali 2012-05-16T18:31:43Z IPS logs https://community.cisco.com/t5/network-security/ips-logs/m-p/1949210#M55256 <P>Hi,</P><P></P><P>My customer have a AIM-IPS and he can't log export to external server.</P><P>How can I logs export from IPS to an external server?</P><P></P><P>Thank you</P> Sun, 10 Mar 2019 12:40:53 GMT https://community.cisco.com/t5/network-security/ips-logs/m-p/1949210#M55256 Luis Carlos Agripino de Carvalho Jr. 2019-03-10T12:40:53Z IPS logs https://community.cisco.com/t5/network-security/ips-logs/m-p/1949211#M55257 <HTML><HEAD></HEAD><BODY><P>IPS logs are stored in the form of events. These events can be retrieved using SDEE (Security Device Event Subscription) from an external client. The event retrieval operations begin with a client initiating an unencrypted HTTP or an encrypted HTTP over TLS/SSL connection with the sensor over which event requests and responses will be communicated. Once a connection is established, the client may initiate requests to the sensor. The sensor acts on the requests and responds back to each of the client's requests with a response.</P><P>There is another type of logs called iplogs which are binary files captured on the interfaces. These can be directly copied off the sensor using "copy iplog" command.</P><P></P><P>Hope this helps.</P><P>Madhu</P></BODY></HTML> Wed, 16 May 2012 18:31:43 GMT https://community.cisco.com/t5/network-security/ips-logs/m-p/1949211#M55257 mkodali 2012-05-16T18:31:43Z