5.x, setting signatures to default

[mhellman]

Is there any way to set JUST the signatures to default in 5.x? I tried doing a select all->default from the GUI but it eventually just times out with some rdep error. I also just tried doing it from the CLI using :

(config)# default service signature-definition sig0

It's been running for an hour.

TIA,

Matt

[mhellman]

I gave up on this. I used the recovery process to re-image to 5.0(1)S149 and then upgraded to the latest version. So now I want to enable all the signatures. This should be a no brainer, but alas it is not working either. Anyone ever been able to enable all signatures on a 5.x sensor? I'm trying from the GUI currently, and it has been processing for about 1 hour so far. I'll try the CLI next.

[cskipper]

When enabling/unretiring all signtuares on a sensor, the sensor must recompile regex strings on those signatures that were retired and disabled. This will take time.

Setting signatures back to default will be available in IPS MC 2.2 due to be released very soon.

Thanks

[cskipper]

When enabling/unretiring all signtuares on a sensor, the sensor must recompile regex strings on those signatures that were retired and disabled. This will take time.

Setting signatures back to default will be available in IPS MC 2.2 due to be released very soon.

Thanks

[mhellman]

It never completed for me at all, eventually just timed out with some RDEP error. I'm not using VMS, I'm hitting the sensor directly.

I found that if I first disable the monitoring

interface, then make the required changes, then re-enabled the monitoring interface...it works fine.