topic Re: FirePower Health Errors in Network Security

FirePower Health Errors

JoshfromPHX — Mon, 31 Oct 2022 16:35:52 GMT

Hello,

I am getting these errors on the firewall and am not 100% sure how to resolve them. Any help on this would be great! Thank you in advance.

ModelSoftware VersionOS

Cisco Firepower Management Center 1600

7.0.2 (build 88)

Cisco Firepower Extensible Operating System (FX-OS) 2.10.1 (build192)

Re: FirePower Health Errors

balaji.bandi — Mon, 31 Oct 2022 16:42:01 GMT

check the physical connection of Eth 1/5 - where this connected to Switch.

Re: FirePower Health Errors

manofsteel03 — Tue, 01 Nov 2022 07:07:46 GMT

We had similar issues a while back and opened a case with Cisco TAC. It was related to a bug and it's only a cosmetic issue. They had me run some commands on FMC to gather some data and then followed up with running another set of commands to delete the specific UUIDs associated with the errors. Suggest opening a case with TAC to assist if you have an active support contract.

*SSH into the FMC and run these commands to gather info:
expert
sudo su
OmniQuery.pl -db mdb -e "select status,category,hex(uuid),body from notification;"

hth

Re: FirePower Health Errors

Marvin Rhoads — Tue, 01 Nov 2022 13:04:49 GMT

Like @manofsteel03 mentioned, this is usually due to a cosmetic bug. Here are more details on how to fix it (from FMC). Run these 3 commands in order. After running the last one, you should see "no rows returned"

OmniQuery.pl -db mdb -e "select status,category,hex(uuid),body from notification where status=11;" OmniQuery.pl -db mdb -e 'delete from notification where uuid=unhex("<insert the uuid that the first command returns here");' OmniQuery.pl -db mdb -e "select status,category,hex(uuid),body from notification where status=11;"

Also covered in this thread:

https://community.cisco.com/t5/network-security/fmc-health-alert-not-clearable-interface-status-modified/td-p/4528153

Re: FirePower Health Errors

JoshfromPHX — Tue, 01 Nov 2022 19:20:55 GMT

Hi Marvin - Thank you for the reply. I ran the command as you recommended but got a permission denied message. Is this to be expected even using the expert command before issuing the commands provided above?

> expert
firepower:~$ OmniQuery.pl -db mdb -e "select status,category,hex(uuid),body from notification where status=11;"
bash: /ngfw/usr/local/sf/bin/OmniQuery.pl: Permission denied
firepower:~$ OmniQuery.pl -db mdb -e 'delete from notification where uuid=unhex( "<insert the uuid that the first command returns here>");'
bash: /ngfw/usr/local/sf/bin/OmniQuery.pl: Permission denied
firepower:~$ OmniQuery.pl -db mdb -e "select status,category,hex(uuid),body from notification where status=11;"
bash: /ngfw/usr/local/sf/bin/OmniQuery.pl: Permission denied

Re: FirePower Health Errors

Marvin Rhoads — Wed, 02 Nov 2022 00:01:09 GMT

You need to run the commands as superuser (su). So first, "sudo su -" to switch user context to superuser. Then all commands will be authorized in that context.

Re: FirePower Health Errors

JoshfromPHX — Wed, 02 Nov 2022 00:11:30 GMT

Perfect thank you. That worked. How long does it take for these errors to go away in the GUI once these have been issued?

Re: FirePower Health Errors

Marvin Rhoads — Wed, 02 Nov 2022 02:13:15 GMT

By default the health monitor policy runs every 10 minutes and will update the GUI at that time. You can go into the FMC health monitor directly and select "Run All" to kick it off manually out of cycle.

Re: FirePower Health Errors

JoshfromPHX — Tue, 08 Nov 2022 17:46:33 GMT

Unfortunately after following the steps above this did not resolve the issue. Is there anything else I can try before I reach out to TAC?