Cisco IDS 4250 High Memory Utilization

Nelsonmejia09 · ‎05-13-2010

Hi,

My Name is Nelson.

I have three Devices IDs implemented but one of them has a high memory utilization (higher to 90%). I have disconnected all interfaces on the IDS but the use of memory remains high. How I can verify what is the origin of this high use from memory and what steps should I followed.

Thanks

rhermes · ‎05-13-2010

First thing you should do is upgrade to the latest version of E4 code in your train (6.0, 6.0, 7.1 etc). Some of the older vsrions of code had a memory leak under certain conditions.

The second thing is to determine if this is being caused by traffic (in which case there is little you can do about it beside swapping in a larger sensor or changing your existing signature policy/actions). If you have three sensors have the same signature poilcy on them you can swap two of the and see if the problem follows the sensor of the traffic (my bet is it follows the traffic)

Lastly you should determine if this is really a problem (maybe this should be first). Are you seeing any missed packet percentages in yoru log?

- Bob