Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

Analysis Engine not running often 5.0(5) Sig 218

Hi

We have 27 4215's running 5.0(5) sig 218 and are finding via "health and Welfare messages" that the analysis engine is not running on some of our sensors. I cannot pin down a pattern and it is random. Each time we see this we restart the CIDS daemon. It will run OK and then stop again. We cannot determine anything from the logs.

Anybody else seeing this, or know what else we could look for to find clues?

Thank you in advance

M

1 ACCEPTED SOLUTION

Accepted Solutions
New Member

Re: Analysis Engine not running often 5.0(5) Sig 218

5.0(6)S220 should be installed. This sp addresses sensorapp problems among other bugs.

-Mario

5 REPLIES
New Member

Re: Analysis Engine not running often 5.0(5) Sig 218

5.0(6)S220 should be installed. This sp addresses sensorapp problems among other bugs.

-Mario

New Member

Re: Analysis Engine not running often 5.0(5) Sig 218

Where can I find the release notes for 5.0(6) to find what was actually fixed? Having a ahrd time tracking it down, and the Readme.txt file doesn't say what is specifically fixed. We are also having that problem running 5.0(5) as well as sensors randomly stopping, that seems to be when updates are pushed out. We either get the same error as above, the analysis engine stops running, or the sensor will just stop responding or crash altogether.

New Member

Re: Analysis Engine not running often 5.0(5) Sig 218

Please ignore this message. I found what I was looking for in the bugtraq

New Member

Re: Analysis Engine not running often 5.0(5) Sig 218

I have installed service pack 6 along with sig 222 and the analysis engine has stabilized.

Thank you

M

New Member

Re: Analysis Engine not running often 5.0(5) Sig 218

I have similar problems running IPS5.1(1d)S220.0 on an IDSM-2 module. I need to reset the sensor atleast once everyday because it does not show any events using "show events". I am sure my network has atleast ICMP events showing up.

Sometimes, the IPS DM launches for a while and then throws an error saying "There was an error, IDM will exit, press Yes" or something like that. Immediately after this, if I try to get access to the IDSM-2 CLI (by sess sl proc 1), no prompt is thrown.

Everything is OK after I reboot the module.

Pls help on how to proceed.

298
Views
0
Helpful
5
Replies
CreatePlease to create content