Easy way to view shunning event

[loverbey]

I'd like to know if there is an easy way to view events that caused the IDS to shun a host.

I understand there is Event Viewer standalone, with VMS and IDM. However, with event viewer, it is difficult to view (search) a specific event that occurred in the past.

Is there another way to show the hostname, IDS action taken AND the trigger?

Thanks,

Larissa

[a-vazquez]

You can use Cisco Info Center - Security Monitoring to view IDS Shun events.

http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/info_ctr/cic_sm36/admin/use_unix.htm