Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Disappearance of signature 5126 – IIS .ida Indexing Service Overflow

Hello all,

Has anyone else seen alerts for signature 5126 go away after installing 3.1(3)S32? The signature is still there, but I am not seeing alerts anymore. (???)

Maybe it's a good thing.

Thanks in advance,

Chris

3 REPLIES
New Member

Re: Disappearance of signature 5126 – IIS .ida Indexing Service

Hi, I am also trying to find out the reason for the disappearance of the 5126 events. I am really glad to see your post - so I know it is not specific to our environment.

In our environment, it does not seem to be related to the v3.1.3-s32 service patch.

Our test system was upgradded to S32 on Sept 18.

Our production system was upgradded to S32 on Sept 26.

We did not detect any 5126 in both environments since Sept 20/21.

I am very interested to know the reason. Thanks.

Bronze

Re: Disappearance of signature 5126 – IIS .ida Indexing Service

Nothing changed for that signature in the S32 signature update. Did something in your environment recently that might effect the traffic the IDS is seeing?

New Member

Re: Disappearance of signature 5126 – IIS .ida Indexing Service

We are getting alerts for the 5126 again since Oct 1.

Is this related to the "code red" flood mode period (20th-27th of the month) and termination period (27th-end of month)?

When we check the trend in our environment, the volume of 5126 events usually go down significantly during these periods. But in Sept, it appears to be completely gone. Looks like it didn't really go away.

117
Views
0
Helpful
3
Replies
CreatePlease login to create content