Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Event Retrieval Functionality Not Working

Hi All

I was hoping some assistance with the following please,

Output from show health
Overall Health Status                                   Red          
Health Status for Failed Applications                   Not Enabled  
Health Status for Signature Updates                     Green        
Health Status for License Key Expiration                Green        
Health Status for Running in Bypass Mode                Green        
Health Status for Interfaces Being Down                 Green        
Health Status for the Inspection Load                   Green        
Health Status for the Time Since Last Event Retrieval   Red        <-- this is the issue, but unsure why.  
Health Status for the Number of Missed Packets          Green        
Health Status for the Memory Usage                      Not Enabled 
Health Status for Global Correlation                    Not Enabled  
Health Status for Network Participation                 Not Enabled

IPS:7.0(5a)E4

IME:7.1.1

Sig:S602 <never installed S601>

Are there any outputs that could help with this?

Regards Craig

10 REPLIES
New Member

Re: Event Retrieval Functionality Not Working

Hi All

I have been checking and it seems as if this is a java issue, I have attached the IME log file.

Does anyone know how to fix this issue??

Regards Craig

Cisco Employee

Event Retrieval Functionality Not Working

Hi,

What version of IDM are you using? Can you try to install it on another machine ?

Mike

Mike
New Member

Event Retrieval Functionality Not Working

Hi.

I have the same problem as Craig. I have IME (not IDM) 7.1.1, just as Craig and IPS version

7.0(5a)E4. It's an AIP-SSM-20 module on an ASA 5540 appliance.

I have this problem since friday, but before it all was functioning good. I have the same problem also on an AIP-SSM-10 module on an ASA 5510 appliance. All happened at the same time.

Please, what could be the solution.

Regards.

New Member

Event Retrieval Functionality Not Working

HI Alessio

Sorry was ment to add this to the thread.

Resolution Summary:  Found that the time on IME and IPS was different, reloaded the IPS to get the current time and the issue is fixed now.


Regards Craig

New Member

Re: Event Retrieval Functionality Not Working

Hi Craig.

Thanks for the quick answer.

I have just resolved in another way (less invasive for the production environment): just stopped and restarted the IME and MySQL server via the services on Windows :O)

The only annoying thing was that I had to replace the gadgets on IME.

Anyway, I don't consider this a "solution" but only a workaround.

Remembering well, this already happened to me the last summer and I used the same IME version. So probably the problem could be inside this version.

Regards.

Alessio

New Member

Event Retrieval Functionality Not Working

Hi Alessio

Yeah that sounds a much better way of recovery....

Regards Craig

New Member

Event Retrieval Functionality Not Working

Hi all.

Both workarounds are useful.

For time sync you may setup your PC and IPS for use NTP. As I have investigated, when time offset between local sensor time and network time is less than 5 minutes sensor doesn't require reboot.

You may monitor your services Cisco IPS manager Express and MySQL-IME on monitoring server by some system as nagios or zabbix which may inform you when one of these services or both are stopped.

You also may setup it for automatic restart of stopped service by binding some script to nagios or you may setup task scheduler on Windows monitoring server to automatically restart services Cisco IPS Manager Express and MySQL-IME every some hours.

So you will not need to manually check and restart services and events will be retrieved.

New Member

Event Retrieval Functionality Not Working

Hi Andrey.

I do use ntp on my network and the pc running IME and IPS modules are syncronized with the same ntp server.

So, in my case probably it was a different problem.

Anyway, so far so good to know :O)

Regards.

Alessio.

New Member

Event Retrieval Functionality Not Working

I understood that main problem is not in NTP but in services stop on monitoring server. My recommendations were typed for you too.

New Member

I know this is an old thread,

I know this is an old thread, but I just had this issue and none of the suggestions worked for an SSM-20 running 7.1(11) in a 5510 running 9.1, IME version 7.2.7.

  My fix and it's been suggested elsewhere and I've done it before is to remove and reload the IME software.  I just wrote down the different gadgets so that I could repopulate the Dashboard the way I wanted it to look.

1972
Views
0
Helpful
10
Replies
CreatePlease to create content