topic export events from specific date in Network Security

export events from specific date

yiwang2005 — Sun, 10 Mar 2019 09:51:05 GMT

Does any one know the syntax to export events with idsalarms.exe from specific date in VMS2.1?

Re: export events from specific date

a-vazquez — Wed, 25 Jan 2006 20:16:29 GMT

The Alarm Export utility (IdsAlarms.exe) is a command-line utility that provides external access to events stored in the database. You can use the Alarm Export utility to perform the following tasks:

Read events from the database and output them to an archive file.

Mark events for deletion from the database.

Unmark events currently marked for deletion in the database.

The syntax is

IdsAlarms [-f"filename"] [-l] [-o] [-s<"clause">] [-a] [-d] [-u] [-z]

Re: export events from specific date

yiwang2005 — Thu, 26 Jan 2006 12:27:11 GMT

My question is really about the "-s<"clause">" syntax and what field names available or needed to sepecify for events of certain date in the database.

In the documentation, the example is <"event_storage_time > 'Jan 24, 2002'">, so I tried something like <"event_storage_time = 'Jan 24, 2002'">, but it generated a file with no events. And I am not even sure "event_storage_time" is the correct field to choose and interested to know what other fields available.

Thanks.

Re: export events from specific date

darin.marais — Thu, 26 Jan 2006 12:50:00 GMT

Try putting the date in this format.

IdsAlarms -s "event_storage_time =20031203"

Re: export events from specific date

yiwang2005 — Thu, 26 Jan 2006 14:02:43 GMT

just tried. no:(

the example in the documentation works, just not what i wanted for a certain date only.

Re: export events from specific date

darin.marais — Thu, 26 Jan 2006 14:47:06 GMT

do you mean between a cirtain period of time, like this...

idsalarms -s"event_storage_time BETWEEN '2004-03-30 17:00' AND '2004-03-30 17:02'"

Re: export events from specific date

yiwang2005 — Thu, 26 Jan 2006 16:22:48 GMT

i was only looking to do certain date, but will be better to get to certain period of time.

Re: export events from specific date

abelardo — Thu, 26 Jan 2006 19:49:57 GMT

I use this command:

Idsalarms.exe -os -s"event_storage_time > 'Dec 20, 2005' AND event_storage_time < 'Dec 27, 2005'"