Export IPS Logging settings

[aweldon]

Hi all, just wondering if anyone knows of a way to do a bulk export of the Logging Settings - Log, Alert, User Defined etc. all at once with an IPS export. We have user defined actions in our Logs and Alerts but would like to replace one with the automatic SAM block from sk110873 and just want to make sure we do not run into unintended blocks.

Is there a way to accomplish this?

Thanks.

[ShadowPeak.com]

Hi all, just wondering if anyone knows of a way to do a bulk export of the Logging Settings - Log, Alert, User Defined etc. all at once with an IPS export. We have user defined actions in our Logs and Alerts but would like to replace one with the automatic SAM block from sk110873 and just want to make sure we do not run into unintended blocks.

Is there a way to accomplish this?

Thanks.

It looks like the IPS->Protections->View->Export View function in the R77.30 SmartDashboard and R80 SmartConsole does not include the Log field for IPS Protections exported to CSV. However check out the ips_export_import tool (sk65627) which will dump a tar file export of an IPS Profile. After unzipping the tar file check out the ips_protections_per_profile.C file which may have what you need. The ips_export_import tool definitely works on a R77.30 SMS, but when I tried it on a R80.10 management server it dumped core so I take it this tool is not supported in R80.10, possibly not in R80 either. :-)

[aweldon]

Thanks for the suggestion. Just exported the file and extracted it. I went looking for two protections that I know are setup to send an email (user defined) but, once locating them in the file there is no :track attribute defined for them.