Event Retrieval Functionality Not Working

craig bache · ‎10-31-2011

Hi All

I was hoping some assistance with the following please,

Output from show health
Overall Health Status                                   Red
Health Status for Failed Applications                   Not Enabled
Health Status for Signature Updates                     Green
Health Status for License Key Expiration                Green
Health Status for Running in Bypass Mode                Green
Health Status for Interfaces Being Down                 Green
Health Status for the Inspection Load                   Green
Health Status for the Time Since Last Event Retrieval   Red        <-- this is the issue, but unsure why.
Health Status for the Number of Missed Packets          Green
Health Status for the Memory Usage                      Not Enabled
Health Status for Global Correlation                    Not Enabled
Health Status for Network Participation                 Not Enabled

IPS:7.0(5a)E4

IME:7.1.1

Sig:S602 <never installed S601>

Are there any outputs that could help with this?

Regards Craig

craig bache · ‎11-01-2011

Hi All

I have been checking and it seems as if this is a java issue, I have attached the IME log file.

Does anyone know how to fix this issue??

Regards Craig

Maykol Rojas · ‎11-02-2011

Hi,

What version of IDM are you using? Can you try to install it on another machine ?

Mike

alexpara72 · ‎12-12-2011

Hi.

I have the same problem as Craig. I have IME (not IDM) 7.1.1, just as Craig and IPS version

7.0(5a)E4. It's an AIP-SSM-20 module on an ASA 5540 appliance.

I have this problem since friday, but before it all was functioning good. I have the same problem also on an AIP-SSM-10 module on an ASA 5510 appliance. All happened at the same time.

Please, what could be the solution.

Regards.

craig bache · ‎12-12-2011

HI Alessio

Sorry was ment to add this to the thread.

Resolution Summary: Found that the time on IME and IPS was different, reloaded the IPS to get the current time and the issue is fixed now.

Regards Craig

alexpara72 · ‎12-12-2011

Hi Craig.

Thanks for the quick answer.

I have just resolved in another way (less invasive for the production environment): just stopped and restarted the IME and MySQL server via the services on Windows :O)

The only annoying thing was that I had to replace the gadgets on IME.

Anyway, I don't consider this a "solution" but only a workaround.

Remembering well, this already happened to me the last summer and I used the same IME version. So probably the problem could be inside this version.

Regards.

Alessio

craig bache · ‎12-12-2011

Hi Alessio

Yeah that sounds a much better way of recovery....

Regards Craig

andrey.dugin · ‎12-12-2011

Hi all.

Both workarounds are useful.

For time sync you may setup your PC and IPS for use NTP. As I have investigated, when time offset between local sensor time and network time is less than 5 minutes sensor doesn't require reboot.

You may monitor your services Cisco IPS manager Express and MySQL-IME on monitoring server by some system as nagios or zabbix which may inform you when one of these services or both are stopped.

You also may setup it for automatic restart of stopped service by binding some script to nagios or you may setup task scheduler on Windows monitoring server to automatically restart services Cisco IPS Manager Express and MySQL-IME every some hours.

So you will not need to manually check and restart services and events will be retrieved.

alexpara72 · ‎12-12-2011

Hi Andrey.

I do use ntp on my network and the pc running IME and IPS modules are syncronized with the same ntp server.

So, in my case probably it was a different problem.

Anyway, so far so good to know :O)

Regards.

Alessio.

andrey.dugin · ‎12-14-2011

I understood that main problem is not in NTP but in services stop on monitoring server. My recommendations were typed for you too.

thompsondj · ‎10-17-2016

I know this is an old thread, but I just had this issue and none of the suggestions worked for an SSM-20 running 7.1(11) in a 5510 running 9.1, IME version 7.2.7.

My fix and it's been suggested elsewhere and I've done it before is to remove and reload the IME software. I just wrote down the different gadgets so that I could repopulate the Dashboard the way I wanted it to look.