IDSM2 sensing interface

[7dallen]

The IDSM2 is not reporting the sensing interface information. Here is the show vers from the sensor.

MainApp 2003_Oct_10_11.16 (Release) 2003-10-10T11:01:13-0500 Running

AnalysisEngine 2003_Oct_10_11.16 (Release) 2003-10-10T11:01:13-0500 NotRunning

Authentication 2003_Oct_10_11.16 (Release) 2003-10-10T11:01:13-0500 Running

Logger 2003_Oct_10_11.16 (Release) 2003-10-10T11:01:13-0500 Running

NetworkAccess 2003_Oct_10_11.16 (Release) 2003-10-10T11:01:13-0500 Running

TransactionSource 2003_Oct_10_11.16 (Release) 2003-10-10T11:01:13-0500 Running

WebServer 2003_Oct_10_11.16 (Release) 2003-10-10T11:01:13-0500 Running

CLI 2003_Oct_10_11.16 (Release) 2003-10-10T11:01:13-0500

Upgrade History:

* IDS-sig-4.1-3-S68 15:57:04 UTC Wed Feb 04 2004

IDS-sig-4.1-3-S70.rpm.pkg 18:05:24 UTC Fri Feb 20 2004

Maintenance Partition Version 1.3(2)

This problem occured after VMS uploaded Sig S70.

The following error is reported

> sh int sens

> Error: The application is processing configuration, please try again later.

Is there a process to reinitialize the AnalysisEngine?

[umedryk · Accepted solution]

There may be some corruption on the image of your modules, and thus causing the errors that you are getting, and is also likely related to the module stop working after sometime. Check these links for more info :

http://www.cisco.com/en/US/products/sw/secursw/ps2113/products_installation_and_configuration_guide_chapter09186a00801a0c95.html#3792

http://www.cisco.com/en/US/products/sw/secursw/ps2113/products_installation_and_configuration_guide_chapter09186a00801a0c95.html#590722 .

[marcabal · Accepted solution]

Whenever show version reports "Not Running" for AnalysisEngine (or any other process) you have run into a software bug.

Generally it is difficult for a user to diagnose the cause of this issue on their own and will require TAC and possibly even developers (through TAC) assistance for determining the reason.

The best method for restarting a "Not Running" service is to reboot/reset your sensor. All of the services should start automatically.

(NOTE: The TAC and development may use other methods for restarting the services but these should only be used under TAC supervision)

If AnalysisEngine stays in a "Not Running" state or returns to the "Not Running" state after a few hours (or days) you need to contact the TAC for assistance.

There are a few known issues that development has been working on which will be released in a service pack once development and testing are complete.

TAC and/or development will be able to help troubleshoot your problem and be able to determine if you are coming across a known issue with a possible workaround. Or they may even have an engineering patch that might fix the problem until the official service pack is released.

[7dallen]

Thanks for the responses. We did reload the application partition, the sensor started working again. Then we loaded the sigs manually, all is well again.