Web cache lost error

[Joe Silver]

For the past month or so I'm seeing this error in our Cisco ASA firewall syslog  "

%ASA-1-332004: Web Cache Cisco_Ironport/web-cache lost"  This error was first seen June 22 and since then I've seen this error about once every week or week and a half.  I did a google search and I'm not getting a hits to what this error is and how to resolve it.  Ironport still functions fine and web filtering is working as usual. Any ideas?

Thanks!

[donnylee]

I assume that it could be related to the lost or flapping WCCP service in the ASA.

You could check the status of the WCCP service in the ASA and keep track of the time the WCCP service has been running. I think the command is

show wccp web-cache

thanks,

Donny

[Erik Kaiser]

Hi Joe,

If this is an issue with WCCP you may also start a rolling packet capture on the WSA filtering for udp port 2048 a.k.a WCCP. When the issue happens again you will just log into the GUI of the WSA and stop the capture. Download it to your desktop and use wireshark to review the Here I ams' from the ASA and the I see yous' from the WSA. In order to set up a filtered packet capture log into the GUI of the WSA -> Support and Help -> Packet capture -> Edit Settings - See image below. Please make sure to submit and commit your changes.

Once you have the capture configured as shown above please go ahead and start the capture.

Sincerely,

Erik Kaiser

WSA Cisco Forums Moderator

[Joe Silver]

Thanks guys for the tips.  I had to relocate the appliance to a different rack and thus power off and back on.  I'll see if I continue to get the alerts from the ASA.

Joe