Using The Event Log To Find Intrusion Alerts - HP ProCurve Switch 2900yl-24G Access Security Manual

Configuring and Monitoring Port Security
Reading Intrusion Alerts and Resetting Alert Flags
ProCurve Switch 2900yl-24G(config)# show interfaces brief
Status and Counters - Port Status
Port Type
----- --------- + --------- ------- ------ ---------- ----- ----- ------
1 100/1000T | No
2 100/1000T | No
3 100/1000T | No
4 100/1000T | No
5 100/1000T | No
6 100/1000T | No
15 100/1000T | No
16 100/1000T | No
17 100/1000T | No
Figure 10-18.Example of Port Status Screen After Alert Flags Reset
10-40
To clear the intrusion from port A1 and enable the switch to enter any
subsequent intrusion for port A1 in the Intrusion Log, execute the port-security
clear-intrusion-flag command. If you then re-display the port status screen, you
will see that the Intrusion Alert entry for port A1 has changed to "No".
(Executing show port-security intrusion-log again will result in the same display
as above, and does not include the Intrusion Alert status.)
ProCurve(config)# port-security a1 clear-intrusion-flag
ProCurve(config)# show interfaces brief
| Intrusion
| Alert Enabled Status Mode
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
For more on clearing intrusions, see "Note on Send-Disable Operation" on
page 10-35

Using the Event Log To Find Intrusion Alerts

The Event Log lists port security intrusions as:
W MM/DD/YY HH:MM:SS FFI: port A3 — Security Violation
where " W " is the severity level of the log entry and
that generated the entry. For further information, display the Intrusion Log,
as shown below.
From the CLI. Type the log command from the Manager or Configuration
level.
Intrusion Alert on port 1 is now cleared.
Down 1000FDx
Down 1000FDx
Down 1000FDx
Down 1000FDx
Down 1000FDx
Down 1000FDx
Down 1000FDx
Down 1000FDx
Down 1000FDx
MDI Flow Bcast
Mode Ctrl Limit
Auto off 0
Auto off 0
Auto off 0
Auto off 0
Auto off 0
Auto off 0
Auto off 0
Auto off 0
Auto off 0
FFI is the system module