Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

IPS EVENTS RETRIVAL

We are not able to see any events on our external SDEE server. Though on SDEE server it says Event source is sucessfully detected. and sessions are clearly seen between IPS and server.

It says Open Subscriptions = 5 , is there any way to see where is the problem on server or on ips. below are the output of few relevant commands,

I have seen a blog https://supportforums.cisco.com/docs/DOC-12515

Where it says

If you have 5 subscriptions open, then you might be running into a problem of too many open subscriptions.  (if you do have 5 open subscriptions, then you may have to clear subscriptions for MARS to open a new one.   The easiest way to do this is to reboot the sensor.  There are, however, other methods as well.  If you have this situation and don't want to reboot the sensor, then let me know and I can give you those other steps.)

So what are the relevant options to troubleshoot this further.

show stat sdee

General

    Open Subscriptions = 5

    Blocked Subscriptions = 0

    Maximum Available Subscriptions = 5

    Maximum Events Per Retrieval = 500

Subscriptions

    sub-2-4bc33b92

       State = Open

       Last Read Time = 11:06:36 UTC Mon Apr 09 2012

       Last Read Time (nanoseconds) = 1333969596531883000

    sub-3-90bdb294

       State = Open

       Last Read Time = 11:56:05 UTC Mon Apr 09 2012

       Last Read Time (nanoseconds) = 1333972565411685000

    sub-4-d874c98c

       State = Open

       Last Read Time = 11:57:38 UTC Mon Apr 09 2012

       Last Read Time (nanoseconds) = 1333972658446086000

    sub-5-b82d955e

       State = Open

       Last Read Time = 12:25:24 UTC Mon Apr 09 2012

       Last Read Time (nanoseconds) = 1333974324613649000

    sub-6-63addcac

       State = Open

--MORE--

      Last Read Time = 06:46:29 UTC Mon Apr 23 2012

       Last Read Time (nanoseconds) = 1335163589727779000

IDSM_A# show stat web-server

listener-443

    session-7

       remote host = 172.31.29.5

       session is persistent = yes

       number of requests serviced on current connection = 1

       last status code = 200

       last request method = GET

       last request URI = cgi-bin/sdee-server

       last protocol version = HTTP/1.1

       session state = processingActionsState

    session-6

       remote host = 172.31.29.5

       session is persistent = yes

       number of requests serviced on current connection = 1

       last status code = 200

       last request method = GET

       last request URI = cgi-bin/sdee-server

       last protocol version = HTTP/1.1

       session state = processingActionsState

    session-4

       remote host = 172.31.29.5

       session is persistent = yes

       number of requests serviced on current connection = 1

       last status code = 200

--MORE--

      last request method = GET

       last request URI = cgi-bin/sdee-server

       last protocol version = HTTP/1.1

       session state = processingActionsState

    session-5

       remote host = 172.31.29.5

       session is persistent = yes

       number of requests serviced on current connection = 1

       last status code = 200

       last request method = GET

       last request URI = cgi-bin/sdee-server

       last protocol version = HTTP/1.1

       session state = processingActionsState

    session-0

       remote host = 172.31.29.5

       session is persistent = yes

       number of requests serviced on current connection = 1

       last status code = 200

       last request method = GET

       last request URI = cgi-bin/sdee-server

       last protocol version = HTTP/1.1

       session state = processingActionsState

    session-1

       remote host = 172.31.29.5

--MORE--

      session is persistent = yes

       number of requests serviced on current connection = 1

       last status code = 200

       last request method = GET

       last request URI = cgi-bin/sdee-server

       last protocol version = HTTP/1.1

       session state = processingActionsState

    session-12

       remote host = 172.31.29.5

       session is persistent = yes

       number of requests serviced on current connection = 1

       last status code = 200

       last request method = GET

       last request URI = cgi-bin/sdee-server

       last protocol version = HTTP/1.1

       session state = processingActionsState

    session-3

       remote host = 172.31.29.5

       session is persistent = yes

       number of requests serviced on current connection = 1

       last status code = 200

       last request method = GET

       last request URI = cgi-bin/sdee-server

       last protocol version = HTTP/1.1

--MORE--

      session state = processingActionsState

    session-9

       remote host = 172.31.29.5

       session is persistent = yes

       number of requests serviced on current connection = 1

       last status code = 200

       last request method = GET

       last request URI = cgi-bin/sdee-server

       last protocol version = HTTP/1.1

       session state = processingActionsState

    number of server session requests handled = 2473653

    number of server session requests rejected = 0

    total HTTP requests handled = 2476496

    maximum number of session objects allowed = 40

    number of idle allocated session objects = 4

    number of busy allocated session objects = 9

summarized log messages

    number of TCP socket failure messages logged = 0

    number of TLS socket failure messages logged = 0

    number of TLS protocol failure messages logged = 0

    number of TLS connection failure messages logged = 56

    number of TLS crypto warning messages logged = 0

    number of TLS expired certificate warning messages logged = 0

    number of receipt of TLS fatal alert message messages logged = 0

--MORE--

crypto library version = 6.2.1.0

Show events shows that there are events on the device in the real time.

1 REPLY

IPS EVENTS RETRIVAL

What specific log collector application is the 172.31.29.5 host?  One possible workaround to avoid a reboot can be found in the release notes of the bug below:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCse68062

565
Views
0
Helpful
1
Replies
CreatePlease to create content