Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

analysis engine stops running after some time on 6500

Hi,

I'v been trying several things to keep my analysis engine alive.

if it is not running I can get it back up by initiating a reboot of the module.

but thats not wanted, data gets lost and I have no history anymore.

can anybody help me to get the analysis engine to stay stable? thanks in advance.

the IDS is approached by IME on GUI for monitoring.

I know my signatures need to be updated, but I? want to get the system stable first, thanks for any help offerd.

below is the sho ver ;

SR-IDS01# sh ver

Application Partition:

Cisco Intrusion Prevention System, Version 6.1(1)E3

Host:

Realm Keys key1.0

Signature Definition:

Signature Update S409.0 2009-06-23

Virus Update V1.4 2007-03-02

OS Version: 2.4.30-IDS-smp-bigphys

Platform: WS-SVC-IDSM-2

Serial Number: SAD093606WD

Trial license, expires: 25-May-2010 UTC

Sensor up-time is 19 days.

Using 1404698624 out of 1983504384 bytes of available memory (70% usage)

system is using 17.7M out of 29.0M bytes of available disk space (61% usage)

application-data is using 37.1M out of 166.8M bytes of available disk space (23% usage)

boot is using 40.6M out of 68.6M bytes of available disk space (62% usage)

application-log is using 533.0M out of 2.8G bytes of available disk space (20% usage)

MainApp M-2008_APR_24_19_16 (Release) 2008-04-24T19:49:05-0500 Running

AnalysisEngine ME-2008_OCT_17_00_32 (Release) 2008-10-17T00:58:23-0500 NotRunning

CLI M-2008_APR_24_19_16 (Release) 2008-04-24T19:49:05-0500

Upgrade History:

* IPS-sig-S379-req-E3 19:00:08 UTC Tue Feb 03 2009

IPS-sig-S409-req-E3.pkg 19:00:07 UTC Thu Jun 25 2009

Maintenance Partition Version 2.1(2)

Recovery Partition Version 1.1 - 6.1(1)E2

Host Certificate Valid from: 26-Oct-2009 to 27-Oct-2011

1 REPLY
Gold

Re: analysis engine stops running after some time on 6500

Wow, where did you get the 6 month trial license?

about your problem: Somthing is making your sensor unstable. How much bandwidth are you putting thru this IDSM? Are you missing any packets?(sh int) Are you experiencing any other problems? (sh stat anal) Are you running any custom sigs? Are you running the default sig settings?

196
Views
0
Helpful
1
Replies