IPS Manager Express (IME) issue

Unanswered Question
Oct 14th, 2009

After installing Cisco IME, if I log off the server it is installed on, the IPS Manager Express service stops. I know there is a reason this happens but I do not remember what and how it occurs. If anyone can tell me how to fix this I would appreciate it. Thanks...

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
andrey.dugin Fri, 10/16/2009 - 06:04

Go to services.msc and check username who launchs MYSQL-IME and Cisco IPS Manager Express.

It must be Local System for proper functioning. I think that your IME processes are started by some user.

rolltidega72 Fri, 10/16/2009 - 06:13

No it is Local System. What I am seeing in the event viewer when I log off is the service stop with a message saying that the service was terminated with the error Access is denied.

It is almost like Local System does not have the rights to keep the service running. I know that the service spawns off a Java program called IMEJava.exe so I am suspecting that maybe the Java process cannot run as local system? Just throwing that out there.

Alltimed Fri, 10/23/2009 - 14:03

Can't believe no one else is having this issue or has a resolution. From what I can tell if you have IME 7.x running on an XP machine the service will terminate when you logoff. This will also apply if you logon to a Win2k3 console session. The service will continue to work if you connect via RDP to a non-console session though.

stleary Sat, 10/24/2009 - 07:53

This is a known problem, tracked by:

CSCtc12978 IME Process stops when user logs off

Currently this is a minor bug, possibly due to the workaround posted in the DDTS Release Notes. I notice this bug has attracted a number of customer care cases recently. Contact your TAC rep if you think it needs to be fixed sooner rather than later.



Farrukh Haroon Sat, 10/24/2009 - 23:17

Thanks for the info Sean.

Please let us know when this bug is fixed.



rolltidega72 Mon, 10/26/2009 - 06:02

Yeah it was fixed with the last IME version before this one came out. Blows my mind that the newest version had the problem come back.

1sinishae1 Thu, 09/06/2012 - 09:28

I'd like to revisit this as we're experiencing this with our IPS.  The service is using the Local System Account. We've upgraded to the latest IPS version (7.2.3) and we're still seeing this service stop and MARS is continually reporting an 'inactive device'. 

Any assistance would be greatly appreciated.

udupa Mon, 09/10/2012 - 06:42


From your post, it appears its not related to IME.  IME and MARS are different products. Are you talking about IPS device being reported inactive device by MARS?. Can you elabarote the issue?

1sinishae1 Mon, 09/10/2012 - 07:01

Thanks for your reply Ganesh.  I'll try an explain what I've seen.  I realize these are seperate products.

The service in our IPS is continually being stopped.  I notice it when I log into the IPS and see the event status as 'Not connected'.  If I verify this in the services, I can confirm it's stopped.  Now, originally i wasn't sure if the following had anything to do with the IPS issue but when I'd look at my MARS logs I did/do see events in there stating 'CS-MARS - inactive reporting device' and it references both my IPSs.

I seperated these two as their own problems and troubleshooted them individually.  In MARS, the password to communicate to the devices was incorrect and I've since entered the correct password and am nowable to discover my IPS. But I still see the 'CS-MARS - inactive reporting device' being reported in MARs.

So, back to the IPS, based on many of the forums I've read, I get the similar issues that others have reported.  Everything thing seems fine until I log out of the IPS.  When I try to log back in after 'x' amount of time, the event status will eventually report 'not connected' and if I check the service, it is stopped.

We thought maybe a version upgrade would assist so we upgraded to 7.2.3 but no luck. 

Please let me know any additional information you require.

udupa Tue, 09/11/2012 - 05:42

Hi, The original issue discussed in this thread was about IME Service shutting down when the user logs out from the IME machine. Its not about log out from the IPS device.

Anyways..I think you are talking about the column Event Status of the device in the IME home page. This will show Not Connected when IPS device is not reachable. During an IPS device reload also it will show as not connected. However, IME will automatically connect when the IPS reloads.

I request you to do the following.

1. Check if the windows service IPS Manager Express is started. ( Control Panel >

Cisco IPS Manager Express). If not, please start it

2. Make sure the credentials of IPS device in IME are valid. Go to the home page of IME gui client. Select the device. Right click and select edit device. Click on ok.

3. Check if event connection is stopped. Go to the home page of IME gui client. Select the device. Click on the toolbar, Start, click on event connection.

4. Check if there are any network communication related issues between IME machine and the IPS device.

Please let us know if you face any issues.

1sinishae1 Tue, 09/11/2012 - 05:55

This is what I'm referring to as well.  I'm just trying to provide some background to our environment and the alerts I see that may or may not be related.  The bottom line issue is that my service is stopping on the IME machine. My apologies if I misused the terminology.

When I see the event status in the IPS manager express (gui) and it says 'not connected' this is when I know that my service has stopped so I restart it everytime.  Is there a difference in needing to restart it in the device list or in the services list?

Regardless of which is correct I'm still wondering why the service continually stops??

udupa Tue, 09/11/2012 - 08:23


When you see the event status "Not connected" it doesnt necessariy mean IME Service is stopped. It could also be due to IPS device not being reachable. 

We havent come across any case of IME service stopping repeatedly. ( Apart from CSCtc12978, where it it shuts down after windows user logout. But this was fixed).

Does windows event viewer or IME service log ( $IMEInstalldirectory/log/service-log.txt) indicate a service shutdown?. In the log file, please look for "IME service stopped"

1sinishae1 Tue, 09/11/2012 - 09:18

The 'not connected' could very well mean something else but when I restart the service then the connection is reestablished.  Again, it might be conincidence but those are my observances.

I'm not sure if something is lost in translation but I am experiencing what you are describing in the sense that if I log out and upon next login, things will stop.  I'm not aware of the time in between taht it takes to stop the servcie as I don't visit the box that frequently but each time (at least every day or every 3rd day) it has stopped and I needed to restart the service.

The event viewer give me this error:  'The Cisco IPS Manager Express Serives terminated with the following error:  Access is Denied"

Again, it's a local account, if I restart the service it starts no problem and guessing it would have the correct permissions assigned if it started the service.

If i look at the IME service log, it just states IME service stopped.

1sinishae1 Tue, 09/11/2012 - 09:21

If I look at the error that proceeds each of those messages 'IME service stopped' there is a one that is consistant before that:

IOException in processRequest:  invalid stream header: 73746F70

udupa Thu, 09/13/2012 - 06:16


Thanks for that info. So it has indeed stopped. We havent come across any such issue. Unfortunately, its very difficult to debug this without the access to the setup. Could you reinstall IME or install IME on seperate box?. Thanks

1sinishae1 Thu, 09/13/2012 - 09:06

I have to admint Ganesh that I'm confused.  I'm trying to describe the same symptoms that people have relayed in this post (earlier) and you're telling me that 'we haven't come across any such issue'? I will try to reinstall IME but I'm not sure that addressed my post.  I do appreciate your insight and I'm not trying to be critical but I don't know how else to explain this.  The only difference, from what I can tell from the person who stated this post, is that our issue didn't happen 'after install' but well after implementation.  Bottom line, my service is continually stopping after I log out and based on what I've read there are quite a few instances of this issue.

Thanks for your assistance.


This Discussion