topic IPS packet captures-disk space in Network Security

IPS packet captures-disk space

jason.giambrone — Sun, 10 Mar 2019 12:22:57 GMT

I have been doing packet captures on High and Medium events and in the IME there is no obvious way to delete old captures. They don't take up alot space but I wanted to know if there is a way to view the disk capacity on the IPS and how I can delete old capture files from the IPS.

IPS packet captures-disk space

Justin Teixeira — Tue, 21 Jun 2011 14:55:01 GMT

Hi Jason,

The ip logging functionality stores the logs in a circular buffer, so there is no need (and no supported way) to delete/manage the old log files - they will be overwritten then new logs necessitate it.

All of the information on ip logging can be found here:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_ip_logging.html#wp1030704

Also, unless you have a specific need for full stream captures for all high/medium events, you can use the "Produce Verbose Alert" action instead of the ip logging actions to capture the offending packet with significantly less resource utilization per alert.

-JT

IPS packet captures-disk space

jason.giambrone — Tue, 21 Jun 2011 15:40:08 GMT

Thanks Justin. I have been relying on the packet captures because the email notifications are not working as you know.

Jason