You may want to telnet to the sensor and confirm that the auths, hosts, routes, and destinations files are all correct. Also... confirm that the daemons file has the proper daemons configured to start... you should have postofficed, loggerd, sapd, fileXferd and packetd configured to run. Do an nrstatus to confirm that all are running. If not, look in ../var/errors.* for the particular log files associated with each daemon... I have had issues with my packetd.conf file before not having some proper settings.. mainly the NameOfPacketDevice parameter..., even though CSPM looks correct. (I use NameOfPacketDevice /dev/e1000g0 instead of NameOfPacketDevice auto) > I very rarely use CSPM unless it is a must. It is clunky and does not work for me! You may also want to try using the web interface for the sensors... as long as you have that enabled. Access to the web interface is controled the same way as telnet/ssh using the sysconfig-sensor utility (access control). I find this much easier and less of a headache than CSPM. Ofcourse I still use telnet/ssh to connect and make changes to my packetd.conf file for signature changes... but that is just me! Cisco also has some type of Event Viewer for the IDS sensors, but it is almost not worth the effort...
