Cisco IPS-4255-K9 Installation Guide - Page 368

Gathering Information Chapter A Troubleshooting • NAC-Displays ARC (block) requests. Note ARC is formerly known as NAC. This name change has not been completely implemented throughout IDM, IME, and the CLI for Cisco IPS 7.0. • status-Displays status events. • past-Displays events starting in the past for the specified hours, minutes, and seconds. • hh:mm:ss-Hours, minutes, and seconds in the past to begin the display. Note The show events command continues to display events until a specified event is available. To exit, press Ctrl-C. To display events from Event Store, follow these steps: Step 1 Step 2 Step 3 Log in to the CLI. Display all events starting now. sensor#@ show events evError: eventId=1041472274774840147 severity=warning vendor=Cisco originator: hostId: sensor2 appName: cidwebserver appInstanceId: 12075 time: 2008/01/07 04:41:45 2008/01/07 04:41:45 UTC errorMessage: name=errWarning received fatal alert: certificate_unknown evError: eventId=1041472274774840148 severity=error vendor=Cisco originator: hostId: sensor2 appName: cidwebserver appInstanceId: 351 time: 2008/01/07 04:41:45 2008/01/07 04:41:45 UTC errorMessage: name=errTransport WebSession::sessionTask(6) TLS connection exce ption: handshake incomplete. The feed continues showing all events until you press Ctrl-C. Display the block requests beginning at 10:00 a.m. on February 9, 2008. sensor# show events NAC 10:00:00 Feb 9 2008 evShunRqst: eventId=1106837332219222281 vendor=Cisco originator: deviceName: Sensor1 appName: NetworkAccessControllerApp appInstance: 654 time: 2008/02/09 10:33:31 2008/08/09 13:13:31 shunInfo: host: connectionShun=false srcAddr: 11.0.0.1 destAddr: srcPort: destPort: protocol: numericType=0 other timeoutMinutes: 40 evAlertRef: hostId=esendHost 123456789012345678 sensor# A-90 Cisco Intrusion Prevention System Appliance and Module Installation Guide for IPS 7.0 OL-18504-01