The following illustration and table explain the elements in the toolbar that resides immediately above the event table in Event Viewer.

The following table lists alphabetically, and describes, all the columns that you can display in a view in Event Viewer. The columns applicable to a particular device vary, as does the presence or absence of event data for a particular event type.

When you save a view, the columns you selected, and their order, are preserved and displayed the next time you open the view. To select which columns to display in the open (and active) view, do one of the following:

• (Preferred method.) Click the Column Chooser icon in the far right of the event table header row (see Event Monitoring Window). The Choose Columns to Display dialog box that opens lists the columns in alphabetical order. You can select or deselect the columns either individually or by using the Select/Unselect All check box. Also, you can click Revert to return to the default column selection for the view.

• Select View > Customize Columns.

• Right-click any column heading and select or deselect a column individually, or select More to open the same dialog box that is used by the View > Customize Columns command.

Note	Most columns other than Description, Event Name, and Receive Time include a filtering function. For more information, see Creating Column-Based Filters.

The time slider resides below the events table when you are using an historical view; it is not used with real-time views. The following illustration explains the time slider; the pagination controls on the right are explained in Time Slider Elements.

You can use the time slider to do the following:

• View the EPS (events per second) trends for the server. You can use the controls on the right to zoom in or out to get a better view of the EPS trends over the time frame that concerns you.

You can also click and drag the background of the time slider to position the time ranges within the window. Moving the background does not affect the selected time range.

• Select a slice of time for displaying events in the table, either by moving the vertical slider or by using the pagination controls. The position of the vertical slider determines the most recent event displayed in the event table. Whenever you alter the time slice, the event table is reloaded with the events that match the time period.

The time range of the events displayed in the event table is determined by the selected time interval. For more information, see Selecting the Time Range for Events.

The following table explains the pagination controls to the right of the time slider.

Table 7. Time Slider Paging Controls

Element	Description
	Previous page (earlier) and next page (later). The size of page varies according to the selected time mode. Note   Using the page controls alternately, for example forward and then back, causes the sort order in the event table to reverse. That is, the latest events go from the top of the table to the bottom, or from the bottom to the top.
	First page (earliest) and last page (most recent).
	Zoom in (smaller total time interval shown) and zoom out (greater time interval shown). Zooming does not change the content of the event table. A shaded blue area indicates the time interval currently displayed in the event table.

The Event Details pane (illustrated in Event Monitoring Window) presents information contained within a single event. The information, which is displayed in multiple tabs within the pane, varies according to the richness of the event and the capability of Event Viewer to parse the data. Components include:

• Displayed Fields Tab—Displays the fields shown in the Event Table.

• Details Tab—Displays all available fields for the selected event. The fields are presented in alphabetical order.

• Explanation Tab—Displays a generic explanation for this event type.

• Related Threats Tab—Displays threats correlated to the event. (IPS Events only.)

• Recommended Action Tab—Displays a generic recommendation for an event of this type. (Syslogs only.)

• Trigger Packet Tab—Displays trigger packet data. (IPS Events only.)

• Context Packet Tab—Displays context packet data from the Source (Attacker) and Destination (Target). (IPS events only.)

• Notes—Enables you to add a note so that you can revisit particular signatures later to see what you or other users have added for a signature or an event. For more detailed information, refer to Signatures Page.

Note	The notes added here will be persistent when you cross-launch to Configuration Manager.

Note	If you have more than one event for a particular signature, then annotating one event will annotate all the events related to that signature.

You can open up to four historical views and one real-time view in Event Viewer. When you open a view, Event Viewer uses the view settings and time range to retrieve events from the event data store and display them in the event table.

• To open a view so that it replaces the currently active open view, do one of the following in Event Viewer:

  • Double-click the view in the views list.

  • Right-click the view in the view list and select Open.

• To open a view in a new tab, do one of the following:

  • Select File > Open View from the menu bar. The Open a View dialog box opens, which is essentially the same as the view list. Select the view and click OK.

  • Right-click the view in the views list and select Open In New Tab.

You can open up to four historical views and one real-time view at one time. When you have multiple views open, they are opened as tabbed windows in the right pane of the main Event Viewer window, in the most recently used area (“tabbed group”) if there is more than one area. The commands to arrange the windows appear if you right-click the tab for the view window as shown in the following illustration.

You have many options for arranging view windows based on your requirements. For example, you might want to compare two views side-by-side, or remove a view from the main window without closing it.

You can use the following techniques to arrange the view windows to get the display that you desire:

• Floating a view—To remove a view from the main Event Viewer window without closing it, right-click the view tab and select Floating. The view is moved to its own window.

If you have already floated a view, you can select Floating to and choose one of the already-floated windows. The view becomes a new tab in that window.

• Docking a view—To move a floating view back to the main Event Viewer window, right-click the view tab and select Docking.

• Arranging views horizontally or vertically for side-to-side comparison—To create a vertical or horizontal arrangement of views to allow for easy comparison, without floating the views, right-click the view tab and select New Horizontal Group or New Vertical Group. These commands split the current tabbed group into the selected layout. You must have at least two views open to use these commands. If you have more than two open views, and you want all of them in separate windows, you need to use the command multiple times.

• Move views to different tabbed groups—If you have several open views, and you have arranged them into horizontal or vertical groups, you can move views among the groups by right-clicking the view tab and selecting Move to Next Tab Group or Move to Previous Tab Group. The commands appear only if views are arranged in a manner where such movement is possible:

• Change the orientation of groups—You can switch between horizontal and vertical layouts by right-clicking the view tab and selecting Change Tab Groups Orientation.

You can customize the appearance of predefined or custom views in the event table to meet your requirements. You can save these changes even in the predefined views.

You can do the following to customize the event table:

• Create column filters to limit the type of events listed. Use the down arrows in the column heading to define the filter as described in Creating Column-Based Filters.

• Create color rules to highlight events based on severity, as described in Configuring Color Rules for a View.

• Change which columns appear in the table by clicking the Column Selector icon to the right of the table heading row, as described in Columns in Event Table.

• Change the width of a column by clicking the right edge of the column heading and dragging it to the desired size.

• Change the order of the columns by clicking the column heading and dragging the column to the position you want.

• Sort the events list by a column by clicking the column heading. The column sorts based on a three-click cycle: ascending, descending, and default order (which is by event reception time).

• Reset the width of the View Selector and Event Monitoring window to their default values by selecting View > Reset Layout.

• Change whether the source and destination columns show IP addresses or host object names, as described in Switching Between Source/Destination IP Addresses and Host Object Names.

You can view source and destination IP addresses or you can view the host object name of objects that match a source or destination IP address. By default, the Event Viewer shows host object names when available.

IP address to host name mapping is supported only for the source and destination of events. Also, the mapping applies to Host objects only; Event Viewer will not show an object name when the source or destination of an event matches a Network object, Group object, or Address Range object.

Please clarify the type and content of the object. E.g. is this feature for host type network/host objects only, that is, the single-value host version of the object? does it work for single-value group objects, or for network or range objects?

To switch between source/destination IP addresses and host object names, do the following:

• To see host objects names for any objects that match a source or destination IP address, select View > Show Network Host Objects. This option is selected by default.

Tip	Hover over a host object name to view the IP address associated with that object.

Note	An IP address to host object name cache is created when Event Viewer is launched. If you define new host objects, you must submit those changes to the database and then close and relaunch Event Viewer for those mappings to be used.

• To see IP addresses in the source and destination columns, deselect View > Show Network Host Objects.

A custom view is one in which you define the filters in the view settings. Using custom views, you can configure filter rules to pin-point specific areas for monitoring and analysis. Custom views are private and cannot be shared between users.

You basically have two options for creating custom views, creating a view from scratch or from an existing view:

• To create a custom view that has no predefined column filters, do one of the following:

  • Select File > New View from the menu bar.

  • Click the New button above the view list.

Then, enter a name for the view and optionally a description of the view and click OK. The view is added to the My Views folder in the views list.

• To create a custom view based on an existing view, do one of the following:

  • With the desired base view open, click the down arrow on the Save button in the event table toolbar and select Save As, or select File > Save As from the menu bar.

  • Right-click the desired base view in the views list and select Save As.

Then, enter a name for the view and optionally a description of the view and click OK. The view is added to the My Views folder in the views list. The new view has the same filters as the base view.

Note	View names can be up to 128 characters and contain alphanumeric characters, spaces, hyphens (-), underscore characters (_), plus signs (+), periods, and ampersands (&). The description can be up to 1024 characters.

After you create the new view, you can customize it the same way that you can an existing view:

• Define filters in the view settings. See Creating Column-Based Filters.

• Define color rules in the view settings. See Configuring Color Rules for a View.

• Select the columns to display in the event table. See Columns in Event Table.

• Customize the event table appearance. See Customizing the Event Table Appearance.

To change the name of a custom view, or the custom view’s description, do one of the following:

• Select the custom view in the view list and click the Edit button above the list.

• Right-click the custom view in the view list and select Edit.

Then, make the desired changes to the custom view name or description and click OK.

Note	View names can be up to 128 characters and contain alphanumeric characters, spaces, hyphens (-), underscore characters (_), plus signs (+), periods, and ampersands (&). The description can be up to 1024 characters.

You cannot change the name or description of a predefined view.

You can update the events table for any view using either real-time or historical time periods. A real-time view shows events as they are received, whereas an historical view shows a static list of events that is not updated until you click the Start button in the event table toolbar.

To switch between real-time and historical time periods in an open view, do the following:

• To see events in real-time, select View > Mode > Real Time, or click the Time Selector control in the event table toolbar and select Real Time. For help in locating the control on the toolbar, see Event Table Toolbar.

• To see events in an historical period, select the desired time frame from the View > Mode menu or from the Time Selector control on the event table toolbar. All options other than Real Time are historical views. For more information, see Selecting the Time Range for Events.

If you edit the settings for a view, you must save it to make those changes permanent. Saving a view saves changes to filters (for custom views only), table preferences such as selected columns, column width, and sort order, the time range, and color rules. If you make filter changes to a predefined view, you must use Save As to create a new custom view.

• To save changes to a view, do one of the following in Event Viewer:

  • Select File > Save from the menu bar.

  • Click the Save button in the event table toolbar.

You are asked to confirm that you want to save your changes.

• To save your changes as a new custom view, do one of the following to open the Save View As dialog box:

  • Select File > Save As from the menu bar.

  • Click the down arrow on the Save button in the event table toolbar and select Save As.

  • Right-click the view in the views list and select Save As.

Then, enter a name for the view and optionally a description of the view and click OK. The view is added to the My Views folder in the views list.

Note	View names can be up to 128 characters and contain alphanumeric characters, spaces, hyphens (-), underscore characters (_), plus signs (+), periods, and ampersands (&). The description can be up to 1024 characters.

You can delete custom views, but you cannot delete predefined views. To delete a custom view, do one of the following:

• Select it in the view list and click the Delete (trash can) button above the list.

• Right-click it in the view list and select Delete.

You are asked to confirm your deletion.

Use the Time Selector control in the event table toolbar, or the equivalent View > Mode command, to select the time range for displaying events. The event table lists only those events that occur within the selected time range. For help in locating the Time Selector control on the toolbar, see Event Table Toolbar.

Tip	For historical views, the time is based on server time, not the time configured on your workstation.

When you change the time range, the table reloads to show events in the selected range. For historical views, you can refresh the events list by clicking Start or by doing the other actions described in Refreshing the Event Table.

The following are your options for the time range:

• To view events from the present time into the past, select one of the following time periods: last 10 minutes, last 1 hour, last 12 hours, last 1 day, or last 1 week.

• To view events from today or yesterday, select today or yesterday, as desired.

• To view events from a specific day, select is on and then select the date from the displayed calendar.

• To view events from a specific date and time range, select is between and select the first and last days and times from the displayed calendars.

• To view real-time events, select Real Time.

When you are using an historical mode, such as “last 10 minutes,” the latest events displayed correspond to the time you selected the time range or opened the view. Similarly, if you are in real-time mode and have clicked Stop, the event table does not include events that arrived after you stopped the event stream.

To refresh the events listed in the event table, so that they are current with your selected time range, do any of the following:

• Click Start in the toolbar, or select View > Start. The table is refreshed based on your currently selected time range. For real-time views, the event stream restarts.

• Select a different time range using the Time Selector in the toolbar or the View > Mode command.

• Select a different time slice using the vertical slider or the pagination controls in the time slider below the event table. For more information on using these controls, see Time Slider.

You can base a new filter on information contained within an event, or a single cell within an event, by right-clicking and choosing a filter command. When you filter using these commands, a column filter is added to the view settings. You can do the following:

• To create a filter based on multiple values in the selected event, select Create Filter from Event, then select from the dialog box the values on which to filter. The dialog box lists only those columns that are displayed in the table; the current values are shown in parentheses. For an explanation of the columns, see Columns in Event Table.

• To filter on only the value in the cell on which you right-click, select Filter This Value.

• To filter to exclude the value in the cell on which you right-click, select Filter Not this Value. All events that do not contain the selected value in this column, including all empty cells, are shown in the table.

• To filter on the flow of the selected event, based on source, source service, destination, and destination service, select Filter This Flow.

Use the quick filter to search for text strings in events. As you type a search keyword, the events table automatically excludes non-matching events as you type. You can search on all columns (the default), or you can select a specific column in which to search.

The following illustration shows the quick filter, which is on the right of the event table toolbar (see Event Table Toolbar).

To perform a search, simply type in the search string. To change how the string is evaluated, click the down arrow next to the Q (magnifying glass) in the left of the edit box. You can limit the search scope using these controls:

• Column name—Select a specific column to search only within that column. The list includes all columns currently displayed in the table. The default is to search all columns.

• Case sensitivity—Select Case sensitive or Case insensitive to control whether capitalization is considered when selecting matches. The default is case insensitive.

• Wild card usage—Select Use Wild Cards to have the following characters evaluated as wild cards:

  • * (asterisk)—matches 0 or more characters.

  • ? (question mark)—matches one character.

• Match method—Select one of the following to determine the location within a cell that the search string should reside:

  • Match from start—The string must be at the beginning of the cell.

  • Match exactly—The cell must contain all and only the search string.

  • Match anywhere—The string can appear anywhere within the cell.

To remove the search string, simply delete it from the quick filter edit box.

For example, if you want to find events that relate to ports that start with tcp/48, type tcp/48 into the quick filter. In the following illustration, note that all but six events are filtered out of the table. In this example, the search string is found in the Source Service column for the first five events, but in the Destination Service column for the sixth event. If you know beforehand that you are interested in destination services only, you could select Destination Service from the quick filter drop-down list and the table would show the last event only.

When you apply filters to the event table, non-matching events are not displayed. You might find that you need to see the non-matching events. You can either open a different view that applies different (or no) filters, or you can clear filters from the current view.

When clearing filters, the filter definition is removed from the view settings, but the change is not permanent until you click Save. Thus, you can remove filters temporarily without redefining the view settings.

You can clear filters one at a time or clear all filters:

• To clear a single filter, so any of the following:

  • Select the filter in the View Settings pane and click Delete.

  • Select (All) from the drop-down list of a filtered column.

  • Right-click in the filtered column and select Clear This Filter.

• To clear all filters, right click in the events table and select Clear all filters.

When you right-click an event in the Event Table, a context menu appears that provides commands that you can use with the selected event. The specific list of available commands depends on the type of event and also the specific cell on which you right-click. The following table explains all of the available commands.

Note

In addition to the right-click options listed below, you can also hover your mouse over a valid IPv4 address in Event Viewer to launch the IP Intelligence tool for that IP address. The IP Intelligence tool provides various pieces of information about an IPv4 address, such as the fully qualified domain name (FQDN), geographic location information, and WHOIS information. For more information on the IP Intelligence tool, see IP Intelligence.

Note	From version 4.17, though Cisco Security Manager continues to support IPS features/functionality, it does not support any bug fixes or enhancements.

Use the IPS Signature Quick Tune dialog box to enable or disable the signature associated with the selected event, and modify the Base Risk Rating of the signature that is assigned to the device or shared policy.

Each event contains a lot of specific information in many separate fields. Typically, you display a subset of these fields in the event table. When you want to see the complete details of an event, you can use either of the following:

• Event Details pane—Select the event and open the Event Details pane below the event table. You can open the pane by clicking anywhere in the “Event Details” title row, or you can select View > Show Event Details from the menu. The Event Details pane organizes the information in tabs. For more information about this pane, see Event Details Pane.

• Event Details dialog box—You can open this dialog box by double-clicking the event, or by right-clicking the event and selecting Show All Details. The information is presented as a flat list and shows the information that would be shown on the Details tab in the Event Details pane. For information on the meaning of the attributes, see Columns in Event Table.

The Event Details dialog box includes the following controls:

• Print button—Click this button to print the information. You are prompted to select a printer.

• Copy button—Click the down arrow on this button and select All Rows or Selected Rows. The information is copied to the clipboard, and you can paste it into another application. Note that the Selected Rows command works only if you select at least one row in the table.

• Next, Previous buttons—Click these buttons to scroll through the events currently displayed in the event table. Next moves up and Previous moves down in the table.

You can copy single events, multiple events, all events, or even the contents of a single cell to the clipboard. You can then paste the information into another application, such as a spreadsheet or an e-mail message.

You can do the following from the event table:

• Copy selected events—To copy one or more selected events, right-click in the event table and select Copy Selected Events. The event you right-click does not matter, the copied events are those that are selected (highlighted) in the table.

Click an event to select it. Hold Ctrl key to select additional events, or hold the Shift key to select a range of events.

• Copy the contents of a single cell—To copy the contents of a single cell in one event, right-click the cell and select Copy Cell. You cannot copy cell contents if there is more than one event selected in the table.

• Copy all events—To copy all the events shown in the event table, right-click anywhere in the table and select Copy All Events.

Rather than copying events to the clipboard and pasting them into another application, you can directly save events to an HTML or comma-separated values (CSV) file. HTML files are useful for viewing information, whereas you can open a CSV file in a spreadsheet application for further analysis and report generation.

When saving event data, you are prompted to select a folder and enter a file name.

You can do the following from the event table:

• Save selected events—To save one or more selected events, right-click in the event table and select either Save Selected Events as HTML or Save Selected Events as CSV. The event you right-click does not matter, the saved events are those that are selected (highlighted) in the table.

Click an event to select it. Hold Ctrl key to select additional events, or hold the Shift key to select a range of events.

• Save all events—To save all the events shown in the event table, right-click anywhere in the table and select either Save All Events as HTML or Save All Events as CSV.

From the Firewall > Access Rules policy in Security Manager, you can select an access rule and view related event information in Event Viewer. You can view real-time or historical events matching the rule. You can view events for ASA (including ASA-SM) and FWSM devices.

Firewall access rules are presented in the form of an ordered list or table. When deployed, this policy becomes an access-control list (ACL), with each entry in the list known as an access-control entry (ACE). (For more detailed information, see Understanding Access Rules.)

When deciding whether to forward or drop a packet, a device tests the packet against each access rule in the ordered listed. If you enable logging for an access rule, the results of the test are recording according to your per-rule log settings. Some devices, such as ASA, generate log entries for denied access even if you do not configure logging explicitly. For information on creating access rules, including logging options, see Configuring Access Rules.

If logging is enabled for the rule (in the Advanced and Edit Options Dialog Boxes), the device sends syslog messages to Event Viewer to record the logged events. This query includes the access-rule parameters, including available keyword information. Reported events do not include connection set-up and tear-down.

To view rule-related events, use the following right-click commands:

• Show Events > Realtime—To view real-time query results in Event Viewer for events matching this rule. You can change the query criteria in the Event Monitoring window at any time, applying new parameters to alter the real-time results.

• Show Events > Historical—To view historical query results in Event Viewer for events matching this rule. You can change the query criteria in the Event Monitoring window at any time, applying new parameters to alter the historical results.

Security Manager provides the following information to Event Viewer as criteria for access-rule event queries:

• Device details—General information about the device, such as host name, domain name, management IP address, and display name.

• Source addresses—Source addresses of hosts and the network/host objects expanded to display the networks or collections of IP addresses.

• Destination addresses—Destination addresses of hosts and the network/host objects expanded to display the networks or collections of IP addresses.

• Service—Protocol and port information.

• Event Type—“Built/teardown/permitted IP connection” for permit rules and “Deny packet due to security policy” for deny rules.

From Health and Performance Monitor, you can quickly access events for a monitored device or for site-to-site VPNs that have had a tunnel up/down event.

To view events for a monitored device, select a device from the All Devices, Firewall Devices, IPS Devices, Priority Devices, or custom device-related view, and with the Summary tab selected in the device details area, click the View Events button. Event Viewer opens and the Event Monitoring window lists events filtered by the selected device and the time period specified by the slider bar.

To view related events for a site-to-site VPN that has had a tunnel up/down event, do one of the following:

• From the Site-to-Site Tunnels view, click on the Down notification hyperlink in the Status column.

• From the Alerts view, click on the hyperlink in the Description column for tunnel up/down alerts.

Event Viewer will show IPSec VPN Events for the device within a time range depending on the polling interval for that device. If it is a priority device, the time range will be 5 minutes before until 5 minutes after the first up/down notification was received. For non-priority devices, the time range will be +/- 10 minutes instead of 5 minutes.

Botnet Traffic Filter events use syslog message numbers 338xxx. However, some messages are informational and require no action on your part.

When viewing syslogs for botnet events, you should be most concerned with the following message numbers. For information on dealing with messages that indicate block listed or allowed traffic, see Mitigating Botnet Traffic. For detailed descriptions of syslog messages, see the Syslog Message document for your ASA software version at http://www.cisco.com/en/US/products/ps6120/products_system_message_guides_list.html .

• 338001 to 338004—Indicate block listed traffic that the ASA is logging, but the ASA is not stopping the traffic. These messages require immediate attention if you want to stop botnet activity that is in progress.

• 338005 to 338008—Indicate block listed traffic that the ASA is logging and dropping. This indicates that the traffic was covered by a drop rule. Thus, your network is being protected, although you still need to disinfect the victim computer.

• 338201, 338202—Indicate greylisted traffic that the ASA is logging but not dropping. These messages can indicate an active botnet connection that needs to be handled immediately.

• 338203, 338204—Indicate greylisted traffic that the ASA is logging and dropping. Your network is protected from this traffic. However, if the greylisted site is legitimate, the fact that the traffic is being dropped might be a problem that requires immediate attention. You can add the greylisted address to the allowed list if you determine it is legitimate and redeploy the configuration, as described in Adding Entries to the Static Database.

• 338305 to 338307, 338310—The ASA could not download the dynamic filter database. Ensure that you configured DNS lookup on the device, and that there is a routable network path to the Cisco Intelligence Security Operations Center. You might need to contact Cisco Technical Support.

• 338309—The Botnet Traffic Filter license is not current, and you cannot download the dynamic database. Purchase and install the appropriate license. The Botnet Traffic Filter license is time-based, so you might have had a valid license that expired.