IPS 4240 - High CPU 100%

Unanswered Question
Aug 4th, 2009

The sensor information -ips on IME is with Analysis Engine Status as Reconfiguring the Engine and not Running Normally . How I do to come back to Running Normally ? The CPU utilization is constant in 100% for 10 days. Is necessary save anything ? What is the meaning of Reconfiguring the Engine ?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
mkodali Mon, 08/10/2009 - 19:05

Looks like one of the sensorApp threads is stuck while reconfiguring the signature Engines. Reconfiguration involves building the regex tables of the Engines and should not take much time after the sensor is working normally. To recover from this situation you can reset the sensor from cli using "reset" command.

rogerio.mitsuo Mon, 08/17/2009 - 04:19

I used the "reset" command and now is working fine. Just one question : if happen again ? Thank you.

Dennis Ariel Le... Tue, 03/08/2011 - 14:47

I have this same issue with two 4240 Appliances running  7.0(2)E4 with IME 7.1.1.

The issue happened 6 months ago and just happen about 7 days ago again..

I did a bug search and reviewed the release notes and cannot find anything about this issue.

The IME shows the CPU at 100%, the signature version is not properly propagated to the IME (they have S551 and IME reports S546)
, plus it stucks on Reconfiguring Engine with Activity: Loadconfigtrojan-udp.

Anyone with any toughts?

proactive99 Wed, 03/09/2011 - 17:19

What did you see in sh tech-support?

Are there lots of "wrapped around" entries?

-Alejin

Dennis Ariel Le... Thu, 03/10/2011 - 06:34

Hello Alejin,

Thanks for your feedback, actually the customer did a reload on both IPS and just informed me that the problem got solved but now there is

/* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman","serif";} "Globlal correlation” error.

Attached the show-tech of both IPS and now that you mention, as a matter of fact there are a lot of "wrapped around" entries in both IPSs.

If you have any insights they would be greatly appreciated.

Regards,

DL.

Actions

This Discussion