Cisco IPS Subscriptions

marcus.reid · ‎09-26-2009

Hi,

We are attempting to move from the old Security Monitor in Cisco Works VMS to the realtime monitor (IPS Event Viewer) within CSM. The problem we are getting is a subscription error from the sensors when trying to open the realtime monitor.

Error Output: "Error: env:Sender-sd:errLimitExceeded-This subscription cannot be opened because the maximum number of subscriptions are already open

Please make sure the password and user name are correct."

I then login to the sensor CLI and issue the following command which indicates all the subscriptions are used:

# show statistics sdee-server

General

Open Subscriptions = 5

Blocked Subscriptions = 2

Maximum Available Subscriptions = 5

Maximum Events Per Retrieval = 500

Subscriptions

sub-103-f05ef2f9

State = Read Pending

Last Read Time = 02:18:47 UTC Sun Sep 27 2009

Last Read Time (nanoseconds) = 1254017927903746000

sub-160-512ad7bd

State = Open

Last Read Time = 18:34:02 UTC Sat Sep 26 2009

Last Read Time (nanoseconds) = 1253990042021593000

sub-161-a56e825f

State = Open

Last Read Time = 19:06:19 UTC Sat Sep 26 2009

Last Read Time (nanoseconds) = 1253991979244898000

sub-162-14e2fa66

State = Read Pending

Last Read Time = 02:18:43 UTC Sun Sep 27 2009

Last Read Time (nanoseconds) = 1254017923766659000

sub-25-61ecf3a3

State = Open

Last Read Time = 02:18:51 UTC Sun Sep 27 2009

Last Read Time (nanoseconds) = 1254017931007785000

Is there any way to manually clear the subscriptions without rebooting sensor?

Farrukh Haroon · ‎09-28-2009

Perhaps you may try the solution mentioned in this earlier post?

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&topicID=.ee6e1fc&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cbe7a0d/0#selected_message

Regards

Farrukh

marcabal · ‎09-28-2009

There is not a command on the sensor itself for closing the older subscriptions.

However, this can be done through a standard web browser using the following URL:

https:///cgi-bin/sdee-server?action=close&subscriptionId=

So if you wanted to close the 2 subscriptions that have not been used since Sat Sep 26th you would use the following 2 URLs (replace the 1.1.1.1 IP address with the actual address of your sensor):

https://1.1.1.1/cgi-bin/sdee-server?action=close&subscriptionId=sub-160-512ad7bd

https://1.1.1.1/cgi-bin/sdee-server?action=close&subscriptionId=sub-161-a56e825f

If you know the actual username used to open the subscription, then I would recommend using that username and password when connecting to the sensor for the above URLs (your browser should prompt for a username and password).

If you do Not know which username was used to open the subscription, then I would recommend trying to use the standard "cisco" account when prompted for the username and password.