Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

bz
New Member

Can't view block list or manually block/unblock from CSPM

This happened after I updated the signatures to S28. Managed is running on the sensor, and shunning still works, but I can't view anything from the CSPM (block list, connection status, network device, etc...) or do manual blocking/unblocking. All of this things are grayed out from the 'Event Viewer - Database Events - CSIDS Alarms' window.

Also, after I applied the signature to the CSPM, then I did a reboot, and a Dr. Watson msg came up saying something like (I couldn't recall the exactly error message) policy manager is not running. Then when I try to login to CSPM, it won't let me. I had to reboot, then I can get into CSPM. Can anyone help me troubleshoot this? Thanks!

5 REPLIES
bz
New Member

Re: Can't view block list or manually block/unblock from CSPM

Any ideas or suggestions? Thanks!

New Member

Re: Can't view block list or manually block/unblock from CSPM

I had a strange issue like this also. The items were grayed out in the Event viewer.

To fix it, I went into the CSPM event viewer, I clicked preferences, and then changed the event severity indicator from icon to color. This seemed to clear the problem.

Hope this helps,

E

bz
New Member

Re: Can't view block list or manually block/unblock from CSPM

Thanks for the reply, but the event severity indicator is in color...

Cisco Employee

Re: Can't view block list or manually block/unblock from CSPM

Have you tried selecting an alarm from the sensor before selecting the menu options?

Some menu items require that an alarm be selected in order for the menu item to know the hostid,orgid, etc.. to use when querying the sensor.

Have you changed which fields are shown in the Event Viewer for an alarm?

Certain fields such as hostid, orgid, applicationid, have to be in the viewer in order to use those menu options. If you remove those entries then the event viewer will not know how to communicate with the sensor.

If you have done this, then go back in and add those fields back into the view for the Event Viewer.

NOTE: Once those fields are removed, the entries for those fields may stay blank for current alarms and only be filled for brand new alarms from the sensor.

bz
New Member

Re: Can't view block list or manually block/unblock from CSPM

Thank you....thank you!!!

91
Views
0
Helpful
5
Replies
CreatePlease login to create content