topic Re: IPS stop event data in event viewer in Network Security

IPS stop event data in event viewer

iqbalkhan — Sun, 10 Mar 2019 10:55:31 GMT

One of my IPS running well and viw event report in event viewer. but suddenly no event come in event viwer. at first i think corrupt the event viwer and install another pc but same result. My sensing interface up and management interface also up. when I excute show events 12:00:00 then event dispaly but when i excute only show events then no response. I already reboot it. but no result so what i take the step ?

thanks

Re: IPS stop event data in event viewer

mhellman — Wed, 02 Jan 2008 15:15:12 GMT

you are right to start by troubleshooting directly on the appliance.

"show events" starts from the current time, so no events may not show up right away. try:

# show events alert past 01:00

this will show alarms for the past hour. if you normally receive lots of alarms in a given hour, this should tell you something.

If you don't see any alarms (and in a given hour you normally would),

use the "packet display" command to verify that you are seeing all the traffic you should be seeing. Are you actually inline?

Re: IPS stop event data in event viewer

iqbalkhan — Thu, 03 Jan 2008 10:40:02 GMT

Its not inline. and when I give command packet display , then dispaly traffic.

Thanks

Biplob