Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member


I have my IPS reporting to MARS and I am currently getting a lot of events that are being caused by metacomponents. It is my understanding that these metacomponents should not be producing any events/alerts.

This is occurring with a number of signatures. Have doubled checked that the signatures are in their default state with no actions defined.

Anyone know where I should start looking or is this the correct behavior.


Re: Metacomponents

One of the signature engine of IPS 6.0 is Meta engine.

Meta-Defines events that occur in a related manner within a sliding time interval. This engine processes events rather than packets. As signature events are generated, the Meta engine inspects them to determine if they match any or several Meta definitions. The Meta engine generates a signature event after all requirements for the event are met.

All signature events are handed off to the Meta engine by SEAP. SEAP hands off the event after processing the minimum hits option. Summarization and event action are processed after the Meta engine has processed the component events.

But the large number of Meta signatures could adversely affect overall sensor performance. You can remove the actions as metacomponents are not to be edited.