C-66
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Appendix C Troubleshooting
Gathering Information
appName: login(pam_unix)
appInstanceId: 2315
time: 2003/01/08 02:41:00 2003/01/08 02:41:00 UTC
syslogMessage:
description: session opened for user cisco by cisco(uid=0)
Clearing Events
Use the
clear events
command to clear Event Store.
To clear events from Event Store, follow these steps:
Step 1
Log in to the CLI using an account with administrator privileges.
Step 2
Clear Event Store:
sensor#
clear events
Warning: Executing this command will remove all events currently stored in the event
store.
Continue with clear? []:
Step 3
Type
yes
to clear the events.
cidDump Script
If you do not have access to IDM or the CLI, you can run the underlying script cidDump from the Service
account by logging in as root and running /usr/cids/idsRoot/bin/cidDump. The cidDump file’s path is
/usr/cids/idsRoot/htdocs/private/cidDump.html.
cidDump is a script that captures a large amount of information including the IPS processes list, log files,
OS information, directory listings, package information, and configuration files.
To run the cidDump script, follow these steps:
Step 1
Log in to the sensor service account.
Step 2
Su to root using the Service account password.
Step 3
Type cidDump /usr/cids/idsRoot/bin/cidDump.
Step 4
Compress the resulting /usr/cids/idsRoot/log/cidDump.html file:
gzip /usr/cids/idsRoot/log/cidDump.html
Step 5
Send the resulting HTML file to TAC or the IPS developers in case of a problem.
For the procedure, see
Uploading and Accessing Files on the Cisco FTP Site, page C-67
.