The show ip audit configuration Command

Use the show ip audit configuration EXEC command to display additional configuration information, including default values that might not be displayed using the show run command. You can tell this configuration is logging to a Syslog server only and not doing anything more than logging events for info signatures (alarm only). It’s performing all three actions on attack signatures:

Rtr1#show ip audit configuration
Event notification through syslog is enabled
Event notification through Net Director is disabled
Default action(s) for info signatures is alarm
Default action(s) for attack signatures is alarm
Default threshold of recipients for spam signature is 25
PostOffice:HostID:0 OrgID:0 Msg dropped:0
          :Curr Event Buf Size:0  Configured:100
Post Office is not enabled - No connections are active
Audit Rule Configuration
 Audit name Audit-1
    info actions alarm
    attack actions alarm drop reset
Rtr1#