Nac - Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Installation And Configuration Manual

System Components
Note

NAC

Note
Cisco Intrusion Detection System Appliance and Module Installation and Configuration Guide Version 4.1
A-16
The IDS applications use LogApp to log messages. LogApp sends log messages
at any of five levels of severity: debug, timing, warning, error, and fatal. LogApp
writes the log messages to /usr/cids/idsRoot/log/main.log, which is a circular text
file. New messages overwrite older messages when the file reaches its maximum
size, therefore the last message written may not appear at the end of the main.log.
Search for the string "= END OF FILE =" to locate the last line written to the
main.log.
The main.log is included in the show tech support command output. If the
message is logged at warning level or above (error or fatal), LogApp converts the
message to an evError event (with the corresponding error severity) and inserts it
in the EventStore.
See Displaying Tech Support Information, page
displaying tech support information. See
page 10-28, for the procedure for displaying events.
LogApp receives all syslog messages, except cron messages, that are at the level
of informational and above (*.info;cron.none), and inserts them into the
EventStore as evErrors with the error severity set to Warning. LogApp and
application logging are controlled through the service logger commands.
LogApp can control what log messages are generated by each application by
controlling the logging severity for different logging zones. You would only
access the individual-zone-control of the logger service at the request and
supervision of a TAC engineer or developer. For troubleshooting purposes, TAC
might request that you turn on debug logging. See
page B-28, for more information.
This section describes NAC, which is the IDS application that starts and stops
blocks on routers, switches, and PIX Firewalls. A block is an entry in a device's
configuration or ACL to block incoming/outgoing traffic for a specific host IP
address or network address.
The legacy application is managed.
Appendix A Intrusion Detection System Architecture
10-31, for the procedure for
Displaying and Clearing Events,
Enabling Debug Logging,
78-15597-02