Cisco IPS log monitoring

[shalendra2]

Hi Team,

               We have a device Cisco IPS 4260-k9. We want to forward syslog events to external syslog server. Please specify

the steps. and also provide the difference, If we use SDEE.

Regards,

Shalendra

[Marvin Rhoads]

Syslog events (UDP-based messages) from a Cisco IPS appliance are only high level system status messages (server up, signature update applied etc.).

Actual intrusion events are only exported via the more reliable tcp-based SDEE. For that you use a client such as Cisco IPS Manager Express (for small deployments) or Cisco Security Manager (enterprise class tool).