Using The Event Log To Find Intrusion Alerts - HP ProCurve Switch 6120G/XG Manual

Configuring and Monitoring Port Security
Reading Intrusion Alerts and Resetting Alert Flags
Figure 11-16.Example of Port Status Screen After Alert Flags Reset
11-36
To clear the intrusion from port A1 and enable the switch to enter any
subsequent intrusion for port A1 in the Intrusion Log, execute the port-security
clear-intrusion-flag command. If you then re-display the port status screen, you
will see that the Intrusion Alert entry for port A1 has changed to "No".
(Executing show port-security intrusion-log again will result in the same display
as above, and does not include the Intrusion Alert status.)
ProCurve(config)# port-security a1 clear-intrusion-flag
ProCurve(config)# show interfaces brief
For more on clearing intrusions, see "Note on Send-Disable Operation" on
page 11-32

Using the Event Log To Find Intrusion Alerts

The Event Log lists port security intrusions as:
W MM/DD/YY HH:MM:SS FFI: port A3 — Security Violation
where " " is the severity level of the log entry and
W
that generated the entry. For further information, display the Intrusion Log,
as shown below.
From the CLI. Type the log command from the Manager or Configuration
level.
Syntax: log < search-text >
For < search-text >, you can use ffi, security, or violation. For example:
Intrusion Alert on port A1 is now
is the system module
FFI