topic Cisco IDSM Event Viewer - Understanding Event ID in Network Security

Cisco IDSM Event Viewer - Understanding Event ID

Ramraj Sivagnanam Sivajanam — Sun, 10 Mar 2019 12:40:38 GMT

Hi Everyone

Attached in this discussion is a screen shot of the Event Viewer. Just to inquire, I see a lof of these message e.g. TIPC: Lost contact with, TIPC: Lost link etc.

Is this a problem? These error messages comes with Event ID, but I'm unable to find the meaning of the Event ID. Can someone advice me please.

Thank you

Regards,

Ram

Cisco IDSM Event Viewer - Understanding Event ID

mkodali — Wed, 16 May 2012 18:07:41 GMT

TIPC messages are communications between the IPS module and the main Chassis. Looks like there are some issues in the communication which may go away after you reset the device. As for the eventID, any event or alert that is generated on the sensor will be assigned a unique ID. This is called the eventID and is used to correlate the summary alerts vs First alerts, Log events to alert events, etc.

Hope this helps

Madhu

Cisco IDSM Event Viewer - Understanding Event ID

Ramraj Sivagnanam Sivajanam — Wed, 16 May 2012 23:38:29 GMT

Hi Madhu

Thank you veyr much for your feedback. Just to understand this better, what you're saying is that the automatically generated eventID (which is a unique ID) is not an ID which I can go to Cisco website to look for its' meaning? Am i right to say this?

Regards,

Ram

Cisco IDSM Event Viewer - Understanding Event ID

mkodali — Wed, 16 May 2012 23:57:40 GMT

That is right. It is auto generated by the sensor and has no meaning.

Madhu

Cisco IDSM Event Viewer - Understanding Event ID

Ramraj Sivagnanam Sivajanam — Thu, 17 May 2012 00:00:37 GMT

Hi Madhu

Thanks for your explanation. Just one last question, if i were to see these TIPC error messages in the near future, the only thing I can do is to reboot the chassis? Is there a cisco document that explains this TIPC error, indicates what problem, possible cause and solution?

Cisco IDSM Event Viewer - Understanding Event ID

mkodali — Thu, 17 May 2012 00:29:11 GMT

Hi Ramraj,

I was talking about resetting the IPS module and not the main chassis. Those messages maybe actually benign and may not need any action on your part. In the later versions of sensor those have been throttled from the log so they are not seen at all.

Madhu