Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Cisco IPS Subscriptions

Hi,

We are attempting to move from the old Security Monitor in Cisco Works VMS to the realtime monitor (IPS Event Viewer) within CSM. The problem we are getting is a subscription error from the sensors when trying to open the realtime monitor.

Error Output: "Error: env:Sender-sd:errLimitExceeded-This subscription cannot be opened because the maximum number of subscriptions are already open

Please make sure the password and user name are correct."

I then login to the sensor CLI and issue the following command which indicates all the subscriptions are used:

# show statistics sdee-server

General

Open Subscriptions = 5

Blocked Subscriptions = 2

Maximum Available Subscriptions = 5

Maximum Events Per Retrieval = 500

Subscriptions

sub-103-f05ef2f9

State = Read Pending

Last Read Time = 02:18:47 UTC Sun Sep 27 2009

Last Read Time (nanoseconds) = 1254017927903746000

sub-160-512ad7bd

State = Open

Last Read Time = 18:34:02 UTC Sat Sep 26 2009

Last Read Time (nanoseconds) = 1253990042021593000

sub-161-a56e825f

State = Open

Last Read Time = 19:06:19 UTC Sat Sep 26 2009

Last Read Time (nanoseconds) = 1253991979244898000

sub-162-14e2fa66

State = Read Pending

Last Read Time = 02:18:43 UTC Sun Sep 27 2009

Last Read Time (nanoseconds) = 1254017923766659000

sub-25-61ecf3a3

State = Open

Last Read Time = 02:18:51 UTC Sun Sep 27 2009

Last Read Time (nanoseconds) = 1254017931007785000

Is there any way to manually clear the subscriptions without rebooting sensor?

2 REPLIES
Cisco Employee

Re: Cisco IPS Subscriptions

There is not a command on the sensor itself for closing the older subscriptions.

However, this can be done through a standard web browser using the following URL:

https:///cgi-bin/sdee-server?action=close&subscriptionId=

So if you wanted to close the 2 subscriptions that have not been used since Sat Sep 26th you would use the following 2 URLs (replace the 1.1.1.1 IP address with the actual address of your sensor):

https://1.1.1.1/cgi-bin/sdee-server?action=close&subscriptionId=sub-160-512ad7bd

https://1.1.1.1/cgi-bin/sdee-server?action=close&subscriptionId=sub-161-a56e825f

If you know the actual username used to open the subscription, then I would recommend using that username and password when connecting to the sensor for the above URLs (your browser should prompt for a username and password).

If you do Not know which username was used to open the subscription, then I would recommend trying to use the standard "cisco" account when prompted for the username and password.

1176
Views
0
Helpful
2
Replies