How can i check my IPS is setup and working correctly? v17.5.5 MR5

Hi,

show ips_conf

show ips-settings

Make sure that you have enabled the "LOGS" under the Policy.

And yes i do have IPS logging enabled...

I did try to clear the IPS Instances then added 2 back, but im unsure if this is right?? The only difference to my own XG is var DETECT_ANOMALIES is no on this XG box but on mine its yes.  What exactly does that setting do and how can i change it?? I did try but couldnt change it to yet.

Thanks

And yes i do have IPS logging enabled...

I did try to clear the IPS Instances then added 2 back, but im unsure if this is right?? The only difference to my own XG is var DETECT_ANOMALIES is no on this XG box but on mine its yes.  What exactly does that setting do and how can i change it?? I did try but couldnt change it to yet.

Thanks

https://community.sophos.com/kb/en-us/133096

This command is somekind of aggressive mode of IPS. 

Ok so i found why i couldnt change that setting, i had to follow one of your posts where you mention to use cish rather than the console.  But that setting can stay off if its off cant it??

I still need to find out if the IPS is actually working still though, do you know which logs i can look at via the shell to check if IPS is running right?

ta