# IDS event recover? **URL:** \ **Category:** Security\ **Created:** [27 April 2021 11:43 UTC](https://community.ipfire.org/t/ids-event-recover/5266 "2021-04-27T11:43:57Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![gh4light](https://community.ipfire.org/user_avatar/community.ipfire.org/gh4light/32/4689_2.png) [@gh4light](https://community.ipfire.org/u/gh4light)\ **Post date:** [27 April 2021 11:43 UTC](https://community.ipfire.org/t/ids-event-recover/5266/1 "2021-04-27T11:43:58Z")
What does the Intrusion Detection System do when it detects a bad event ? Does it ring a bell, produce a notice on the root console, reboot the PC, crash, log the bad event in a hidden log file, or call home and hope someone is available ? ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [27 April 2021 19:31 UTC](https://community.ipfire.org/t/ids-event-recover/5266/2 "2021-04-27T19:31:17Z")
No hidden logs! See menu **Logs** → **IPS Logs** or: [https://ipfire:444/cgi-bin/logs.cgi/ids.dat](https://ipfire:444/cgi-bin/logs.cgi/ids.dat) ---
**Author:** ![anon45931963](https://community.ipfire.org/letter_avatar_proxy/v4/letter/a/b9e5f3/32.png) [@anon45931963](https://community.ipfire.org/u/anon45931963)\ **Post date:** [28 April 2021 11:10 UTC](https://community.ipfire.org/t/ids-event-recover/5266/3 "2021-04-28T11:10:34Z")
> [@gh4light](#): > > What does the Intrusion Detection System do when it detects a bad event ? > Does it ring a bell, produce a notice on the root console, reboot the PC, crash, log the bad event in a hidden log file, or call home and hope someone is available ? Some rules are alert only (stamps a log entry and nothing else). Other rules Drop the connection and write to the log (Just like firewall does but different log as per Jon’s answer above). You should ship the logs somewhere like elastic and process them and fire off alerts about proper nasty things 😃 ---
**Author:** ![cbrown](https://community.ipfire.org/user_avatar/community.ipfire.org/cbrown/32/16342_2.png) [@cbrown](https://community.ipfire.org/u/cbrown)\ **Post date:** [28 April 2021 11:53 UTC](https://community.ipfire.org/t/ids-event-recover/5266/4 "2021-04-28T11:53:10Z")
My simple cave-man approach uses the swatch addon to monitor /var/log/suricata/fast.log. When a new entry is written to the log, I have swatch send an email containing the new log entry data [Edit] FWIW the two most popular hits I get are: [https://www.snort.org/rule\_docs/1-28556](https://www.snort.org/rule_docs/1-28556) [https://www.snort.org/rule\_docs/1-28557](https://www.snort.org/rule_docs/1-28557) ---
**Author:** ![gh4light](https://community.ipfire.org/user_avatar/community.ipfire.org/gh4light/32/4689_2.png) [@gh4light](https://community.ipfire.org/u/gh4light)\ **Post date:** [30 April 2021 15:56 UTC](https://community.ipfire.org/t/ids-event-recover/5266/5 "2021-04-30T15:56:40Z")
Thanks to C.Brown for the cave-man info re swatch. I am not familiar /w swatch. Is that a Pakint add on ? Can you please explain what I must do to set it up as you have to see new entries in the fast.log, Thanks again. ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [30 April 2021 17:16 UTC](https://community.ipfire.org/t/ids-event-recover/5266/6 "2021-04-30T17:16:04Z")
here is some info about swatch: > **[Swatch - The IPFire Wiki](https://wiki.ipfire.org/addons/swatch)** ---
**Author:** ![cbrown](https://community.ipfire.org/user_avatar/community.ipfire.org/cbrown/32/16342_2.png) [@cbrown](https://community.ipfire.org/u/cbrown)\ **Post date:** [30 April 2021 18:49 UTC](https://community.ipfire.org/t/ids-event-recover/5266/7 "2021-04-30T18:49:03Z")
It’s been a while since I set this up but I basically muddled through the Wiki and did some web searching about. You would need to get outbound email setup via the WUI “System → Mail Service”. Grepping through my local files, I have a terribly sophisticated swatch config file /var/ipfire/suricata/swatch.conf – containing: > watchfor /./ > mail addresses=_dest-email-addr-here_ subject=“Firewall Rule Fired” In file /etc/sysconfig/rc.local, I have the following > /usr/bin/swatch --daemon --config-file=/var/ipfire/suricata/swatch.conf --tail-file=/var/log/suricata/fast.log --pid-file=/var/run/swatch.pid Edit: I think I’ll change that email subject to something like “Firewall Intrusion Event Triggered”