Alerter CLI Commands
This section list Alerter CLI commands.
The Alerter subsystem transmits messages that have been queued by other components - correlation alerts that have been queued by the Anomaly Detection subsystem, or run-time alerts that have been generated by security policies, for example. The Alerter subsystem can be configured to send messages to both SMTP and SNMP servers. Alerts can also be sent to syslog or custom alerting classes, but no special configuration is required for those two options, beyond starting the Alerter. There are four types of Alerter commands. Use the links in the lists, or browse the commands, which are listed in alphabetical sequence following the lists.
Alerter Start-up and Polling Commands
- stop alerter
- restart alerter
- store alerter state operational
- store alerter state startup
- store alerter poll
- store anomaly-detection poll
- store anomaly-detection state
SMTP Configuration Commands
- store alerter smtp authentication password
- store alerter smtp authentication type
- store alerter smtp authentication username
- store alerter smtp port
- store alerter smtp relay
- store alerter smtp returnaddr
SNMP Configuration Commands
- store alerter snmp community
- store alerter snmp traphost
restart alerter
Restarts the Alerter. You can perform the same function using the store alerter state operational command to stop and then start the alerter:
store alerter state operational off
store alerter state operational on
Syntax
restart alerter
stop alerter
Stops the Alerter.
You can perform the same function using the store alerter state operational command:
store alerter state operational off
Syntax
stop alerter
store alerter poll
Starts (on) or stops (off) the Alerter. The default state at installation time is off. You can also use the restart alerter or stop alerter commands to restart or stop the Alerter subsystem.
Syntax
store alerter state operational <on | off>
Show Command
show alerter state operational
store alerter state operational
Sets the number of seconds, n, that the Alerter waits before checking its outgoing message queue to send SNMP traps or transmit email using SMTP. The default is 30.
Syntax
store alerter poll <n>
Show Command
show alerter poll
store alerter state startup
Enables or disables the automatic start-up of the Alerter on system start-up. The default state at installation time is off.
Syntax
store alerter state startup <on | off>
Show Command
show alerter state startup
store anomaly-detection poll
Sets the Anomaly Detection polling interval, in minutes (n). This controls the frequency with which Guardium® checks log data for anomalies.
Syntax
store anomaly-detection poll <n>
Show Command
show anomaly-detection poll
store anomaly-detection state
Enables or disables the Anomaly Detection subsystem, which executes all active statistical alerts, checks the logs for anomalies, and queues alerts as necessary for the Alerter subsystem.
Syntax
store anomaly-detection state <on | off>
Show Command
show anomaly-detection state
store alerter smtp authentication password
Sets the alerter SMTP authentication password to the specified value. There is no corresponding show command.
Syntax
store alerter smtp authentication <value>
store alerter smtp authentication type
Sets the authentication type required by the SMTP server to the one of the following values:
none: Send without authentication.
auth: Username/password authentication. When used, set the user account and password using the following commands:
store alerter smtp authentication username
store alerter smtp authentication password
Syntax
store alerter smtp authentication type <none | auth>
Show Command
show alerter smtp authentication type
store alerter smtp authentication username
Sets the alerter SMTP email authentication username to the specified name.
Syntax
store alerter smtp authentication username <name>
Show Command
show alerter smtp authentication username
store alerter smtp port
Sets the port number on which the SMTP server listens, to the value specified by n. The default is 25 (the standard SMTP port).
Syntax
store alerter smtp port <n>
Show Command
show alerter smtp port
store alerter smtp relay
Sets the ip address of the SMTP server to be used by the Guardium appliance.
Syntax
store alerter smtp relay <ip address>
Show Command
show alerter smtp relay
store alerter smtp returnaddr
Sets the return email address for email alerts. Any bounced messages or email failures will be returned to this address.
Syntax
store alerter smtp returnaddr <email address>
Show Command
show alerter smtp returnaddr
store alerter snmp community
Sets the SNMP trap community used by the Alerter, to the name specified. There is no corresponding show command.
Syntax
store alerter snmp community <name>
store alerter smtp traphost
Sets the Alerter SNMP trap server to receive alerts, to the specified IP address or DNS host name.
Syntax
store alerter snmp traphost <snmp host>
Show Command
show alerter snmp traphost
store syslog-trap
Usage: store syslog-trap ON | OFF