cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
778
Views
0
Helpful
4
Replies

ASA reports error: "internal error in es_PostEvent: event argument tag is unknown"

zheka_pefti
Level 2
Level 2

Hi gurus!

Can anyone please shed me some light on this error our client receives on their production ASA5510 firewall?

The syslog error ID is 216001 and it says exactly what I wrote in the title: internal error in es_PostEvent: event argument tag is unknown. There are lots of this errors and they overload the syslog. I can of course stop them sent to syslog but I really would like to know the reason.

Eugene

4 Replies 4

Kureli Sankar
Cisco Employee
Cisco Employee

Here is the link for that syslog message:

http://www.cisco.com/en/US/docs/security/asa/asa72/system/message/logmsgs.html#wp3457118

CSCsh88405

ASA Syslog:
%ASA-3-216001: internal error in es_PostEvent: invalid descriptor

Conditions:

This bug should only affect ASAs that are configured for VPN. This instance of the 216001 syslog indicates a software error when generating a ISAKMP syslog or debug.  The logger is looking up the text for an event and no text is defined.

Workaround:

None. This bug only cosmetic and does not affect performance.

http://tools.cisco.com/Support/BugToolKit/

you can go to the above link login with your CCO ID and then key in this defect ID CSCsh88405

and find out the code it is resolved in.

-KS

Thanks, pal.

The ASA indeed runs version 7.x and it terminates a lot of tunnels.

Will this error go away if it is upgraded to 8.x code ?

Eugene

If you run a code where this cosmetic bug is fixed yes, you won't see this message anymore.

-KS

Thanks a lot, KS.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: