No alerts in IME - CISCO IPS 4240

Unanswered Question
Dec 1st, 2008

Hellow everyone,

Im facing some problem alerts not coming in IME (6.1) from the Cisco IPS 4240 (5.1.7E1). Once I reboot the IPS then the alerts are coming and works for 3-4 days and again the problem starts.

I have found one similar netpro case and tried repairing the IME Mysqlcheck.exe, but no success.

Is there something I can configure in the IPS by which it should not send all the traffics into the IME ??

I think its a traffic related issue btw IPS & IME..

Pls share your valid inputs...



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 2 (1 ratings)
mathias.mahnke Tue, 12/02/2008 - 12:13

Hi Raj,

we do discover the same issue. I've opened a TAC case, but it's so far unsolved. As a workaround one can restart the IME windows server or the services (mysql+ime) on a regular basis.

We are running ASA with AIP IPS modules.



Sec IT Tue, 12/02/2008 - 22:35

Hi Mathias,

Thanks for sharing the info..

Let me know will that restarting of IME will temporarily solve the problem ? B'cose if I restart the IPS the problem will be solved for 3 days and again the issue comes back.

Could you let me know what did the TAC say about this .. If they have provided you any of the troubleshooting steps please please share me..

Is that could be because of hug traffic coming into the IPS and IPS not forwarding the logs to IME... or how is it. So many questions are arising in my mind..

Thanks a lot Mathias..

Pls reply...


mathias.mahnke Tue, 12/02/2008 - 23:52

Hi Raj,

for us the service restart "solves" the problem for the same time period but is less invasive for the network infrastructure.

I'll let you know if I recieve any new information. Currently the ticket owner is out of office for some days. May be I'll request a transfer.

Sadly I do not find much information how IME and IPS are communication to get deeper into possible reasons myself. I wonder how many IME users discover this problem? I guess we are not the only one at the moment.



Sec IT Wed, 12/03/2008 - 00:30

Hi Mathias,

Thank you..

Yes There are many customer facing the same issue. This will be helpful if you could give solution from the ticket owner whereby other netpro users can also solve such type of issues...

Pls keep me posted ..


ankurs2008 Mon, 12/08/2008 - 23:21


I am also facing the same issue , suddenly a day events wil stop coming on IME .I intilaly thought it is an issue with MYSQL database however after some time I manually moved the tables to a different drive ,Still i encountered the same issue .I Beileve that there is a bug associated in this IME as it only the first version and probably will be fixed out in the next version of the IME


mathias.mahnke Mon, 12/15/2008 - 06:42

Hi all,

there is now a Cisco BugID:

CSCsu50747 IME stops recording IPS events after a few days and has to be


Information from the TAC: ...bugs have been fixed, but not yet integrated, so it will take some more time to know the version to use to have the fixes.

Sounds good to me. We'll wait for a new release. Everyone facing this issue is fine in opening an own ticket at the TAC (to may be clarifiy if this is really the same issue/solution and get possible an interims relase or bugfix in advance...).



Sec IT Wed, 12/17/2008 - 10:31

Hi Mathias,

I also opened a case with cisco and as per them I have fine tuned the signatures...

Its under observation for few days..



Sec IT Tue, 02/10/2009 - 20:08

Hi All,

The problem has been resolved..

Its a known bug and cisco has release fix for this. In order to get the new patch you need to open a case with cisco and they will give you the patch immly.

Once you get the patch do let me know, i can assist you to install it.


Rajesh P


This Discussion