Restarting Analysis Engine on IDSM-2

vicente.madrigal · ‎12-18-2008

Hi All,

I have an IDSM-2 module and I have noticed that the analysis engine stops very frequently (I do a show version and I see the analisys engine not running). Is there a way to restart it without reseting the module?

I also see the following message:

Note: /etc/modules.conf is more recent than /lib/modules/2.4.30-IDS-smp-bigphys/modules.dep

does anybody know what does it mean?

Regards

jnommensen · ‎12-18-2008

I've had this happen on a few different IDS devices since we upgraded to E3. I've worked with TAC and they never told me a way to restart the anal engine without rebooting the device.

vicente.madrigal · ‎12-19-2008

Hi Jeremy,

How did you fix the issue? do you downgrade your IDS to E2?

Regards

jnommensen · ‎12-19-2008

Hi Vicente,

The work around was to disable auto-update, sigs 3333 and 5597 (SMB MSRPC Messenger Overflow). I have no idea why this was the work around but it seems to have worked. They are also supposed to have a minor version upgrade on Monday that fixes this issue I just found out.

Cheers