cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1527
Views
0
Helpful
5
Replies

IPS 4240 - High CPU 100%

rogerio.mitsuo
Level 1
Level 1

The sensor information -ips on IME is with Analysis Engine Status as Reconfiguring the Engine and not Running Normally . How I do to come back to Running Normally ? The CPU utilization is constant in 100% for 10 days. Is necessary save anything ? What is the meaning of Reconfiguring the Engine ?

5 Replies 5

mkodali
Cisco Employee
Cisco Employee

Looks like one of the sensorApp threads is stuck while reconfiguring the signature Engines. Reconfiguration involves building the regex tables of the Engines and should not take much time after the sensor is working normally. To recover from this situation you can reset the sensor from cli using "reset" command.

I used the "reset" command and now is working fine. Just one question : if happen again ? Thank you.

I have this same issue with two 4240 Appliances running  7.0(2)E4 with IME 7.1.1.

The issue happened 6 months ago and just happen about 7 days ago again..

I did a bug search and reviewed the release notes and cannot find anything about this issue.

The IME shows the CPU at 100%, the signature version is not properly propagated to the IME (they have S551 and IME reports S546)
, plus it stucks on Reconfiguring Engine with Activity: Loadconfigtrojan-udp.

Anyone with any toughts?

What did you see in sh tech-support?

Are there lots of "wrapped around" entries?

-Alejin

Hello Alejin,

Thanks for your feedback, actually the customer did a reload on both IPS and just informed me that the problem got solved but now there is

"Globlal correlation” error.

Attached the show-tech of both IPS and now that you mention, as a matter of fact there are a lot of "wrapped around" entries in both IPSs.

If you have any insights they would be greatly appreciated.

Regards,

DL.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: