idsalarms

[darin.marais]

Is there a way to purge all of the events in the vms database that come from a particular sensor using the idsalarms.exe command?

[Jeffrey Bollinger]

I believe so. From looking at:

http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/mon_sec/secmon12/ug/ch07.htm#130939

I think you can use the following syntax:

-s"orig_app_ip_addr_str ='xx.xx.xx.xx'"

where 'x.x.x.x' is the IP address of the sensor device. Note the single quotes around the IP address string.

[darin.marais]

i tried the command and i recieve the following msg

Error: SybaseESql::executeSql EXECUTE Column 'orig_app_ip_addr_str' not found