Cisco IPS Subscriptions

Unanswered Question
Sep 26th, 2009
User Badges:

Hi,


We are attempting to move from the old Security Monitor in Cisco Works VMS to the realtime monitor (IPS Event Viewer) within CSM. The problem we are getting is a subscription error from the sensors when trying to open the realtime monitor.


Error Output: "Error: env:Sender-sd:errLimitExceeded-This subscription cannot be opened because the maximum number of subscriptions are already open

Please make sure the password and user name are correct."


I then login to the sensor CLI and issue the following command which indicates all the subscriptions are used:


# show statistics sdee-server

General

Open Subscriptions = 5

Blocked Subscriptions = 2

Maximum Available Subscriptions = 5

Maximum Events Per Retrieval = 500

Subscriptions

sub-103-f05ef2f9

State = Read Pending

Last Read Time = 02:18:47 UTC Sun Sep 27 2009

Last Read Time (nanoseconds) = 1254017927903746000

sub-160-512ad7bd

State = Open

Last Read Time = 18:34:02 UTC Sat Sep 26 2009

Last Read Time (nanoseconds) = 1253990042021593000

sub-161-a56e825f

State = Open

Last Read Time = 19:06:19 UTC Sat Sep 26 2009

Last Read Time (nanoseconds) = 1253991979244898000

sub-162-14e2fa66

State = Read Pending

Last Read Time = 02:18:43 UTC Sun Sep 27 2009

Last Read Time (nanoseconds) = 1254017923766659000

sub-25-61ecf3a3

State = Open

Last Read Time = 02:18:51 UTC Sun Sep 27 2009

Last Read Time (nanoseconds) = 1254017931007785000


Is there any way to manually clear the subscriptions without rebooting sensor?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
marcabal Mon, 09/28/2009 - 08:48
User Badges:
  • Cisco Employee,

There is not a command on the sensor itself for closing the older subscriptions.


However, this can be done through a standard web browser using the following URL:

https:///cgi-bin/sdee-server?action=close&subscriptionId=


So if you wanted to close the 2 subscriptions that have not been used since Sat Sep 26th you would use the following 2 URLs (replace the 1.1.1.1 IP address with the actual address of your sensor):

https://1.1.1.1/cgi-bin/sdee-server?action=close&subscriptionId=sub-160-512ad7bd

https://1.1.1.1/cgi-bin/sdee-server?action=close&subscriptionId=sub-161-a56e825f


If you know the actual username used to open the subscription, then I would recommend using that username and password when connecting to the sensor for the above URLs (your browser should prompt for a username and password).


If you do Not know which username was used to open the subscription, then I would recommend trying to use the standard "cisco" account when prompted for the username and password.



Actions

This Discussion