Configuring Automatic IP Logging

Configuring Automatic IP Logging

You can configure a sensor to generate an IP session log when the sensor detects an attack. All packets to and from the source address of the alarm are logged for a specific period of time when IP logging is configured as a response action for a signature and the signature is triggered. Additionally, you can set the number of minutes events are logged. The IP log file is in the tcpdump format for ease of exporting into other tools if required. Follow these steps to set the amount of minutes of automatic IP logging and see Figure 5.19 for the screen shot of the IDSM interface:

Figure 5.19: Configuring Automatic IP Logging Using the Cisco IDM

1. Select Configuration | Logging | Automatic IP Logging in the IDS Device Manager main window.

2. Enter the number of minutes you want IP logging to be done (from 1 to 60) in the Minutes of IP Logging field. Note that the default is 15. Click OK.

3. Select Monitoring | Logs | IP Logs | Archived to download the logs.