Table of Contents
Advertisement
Appendix A
Intrusion Detection System Architecture
Note
Error Events
Cisco Intrusion Detection System Appliance and Module Installation and Configuration Guide Version 4.1
78-15597-02
Errors and warnings are not considered state information and are reported using
evError rather than evStatus.
The following elements are contained in an evStatus event message:
applicationStarted—The originating application has started running and has
•
completed its initialization. This event message provides the application's
version and confirms that the application successfully started.
•
applicationStopped—The specified application has been intentionally shut
down. This event message is sent by a management application that is
responsible for shutting down the application, rather than by the application
that is shutting down.
•
certificatesChanged—Indicates that the host's X.509v3 certificates were
changed.
•
configChanged—Indicates that a configuration file has been modified by a
setConfig control transaction request.
•
ipLogAdded—A new IP logging session has been requested. This event
message also contains the address being logged, the time that it was initiated,
and the identifier for the newly created logging session.
ipLogCompleted—An IP logging session has ended (because of packet count
•
or timeout exceeded). The event message contains the log session's identifier.
ipLogRemoved—An IP logging document is no longer available for retrieval.
•
For reference purposes the event message contains the original logging
session's identifier, although this identifier is no longer valid because the
document was deleted.
ipLogStarted—An IP logging session has been started and at least one packet
•
has been logged. The event document contains the address being logged, the
time that it was initiated, and the log session's identifier.
•
loginAction—A login action, such as a user logging in or logging out, has
occurred.
Error events are generated by an IDS application when the application detects an
error or warning condition. The evError event contains error code and a textual
description of the error.
System Components
A-41
Advertisement
Table of Contents
Troubleshooting
