IPS EVENTS RETRIVAL

tarunava-konar — Sun, 10 Mar 2019 12:39:43 GMT

We are not able to see any events on our external SDEE server. Though on SDEE server it says Event source is sucessfully detected. and sessions are clearly seen between IPS and server.

It says Open Subscriptions = 5 , is there any way to see where is the problem on server or on ips. below are the output of few relevant commands,

I have seen a blog https://supportforums.cisco.com/docs/DOC-12515

Where it says

If you have 5 subscriptions open, then you might be running into a problem of too many open subscriptions. (if you do have 5 open subscriptions, then you may have to clear subscriptions for MARS to open a new one. The easiest way to do this is to reboot the sensor. There are, however, other methods as well. If you have this situation and don't want to reboot the sensor, then let me know and I can give you those other steps.)

So what are the relevant options to troubleshoot this further.

show stat sdee

General

Open Subscriptions = 5

Blocked Subscriptions = 0

Maximum Available Subscriptions = 5

Maximum Events Per Retrieval = 500

Subscriptions

sub-2-4bc33b92

State = Open

Last Read Time = 11:06:36 UTC Mon Apr 09 2012

Last Read Time (nanoseconds) = 1333969596531883000

sub-3-90bdb294

State = Open

Last Read Time = 11:56:05 UTC Mon Apr 09 2012

Last Read Time (nanoseconds) = 1333972565411685000

sub-4-d874c98c

State = Open

Last Read Time = 11:57:38 UTC Mon Apr 09 2012

Last Read Time (nanoseconds) = 1333972658446086000

sub-5-b82d955e

State = Open

Last Read Time = 12:25:24 UTC Mon Apr 09 2012

Last Read Time (nanoseconds) = 1333974324613649000

sub-6-63addcac

State = Open

--MORE--

Last Read Time = 06:46:29 UTC Mon Apr 23 2012

Last Read Time (nanoseconds) = 1335163589727779000

IDSM_A# show stat web-server

listener-443

session-7

remote host = 172.31.29.5

session is persistent = yes

number of requests serviced on current connection = 1

last status code = 200

last request method = GET

last request URI = cgi-bin/sdee-server

last protocol version = HTTP/1.1

session state = processingActionsState

session-6

remote host = 172.31.29.5

session is persistent = yes

number of requests serviced on current connection = 1

last status code = 200

last request method = GET

last request URI = cgi-bin/sdee-server

last protocol version = HTTP/1.1

session state = processingActionsState

session-4

remote host = 172.31.29.5

session is persistent = yes

number of requests serviced on current connection = 1

last status code = 200

--MORE--

last request method = GET

last request URI = cgi-bin/sdee-server

last protocol version = HTTP/1.1

session state = processingActionsState

session-5

remote host = 172.31.29.5

session is persistent = yes

number of requests serviced on current connection = 1

last status code = 200

last request method = GET

last request URI = cgi-bin/sdee-server

last protocol version = HTTP/1.1

session state = processingActionsState

session-0

remote host = 172.31.29.5

session is persistent = yes

number of requests serviced on current connection = 1

last status code = 200

last request method = GET

last request URI = cgi-bin/sdee-server

last protocol version = HTTP/1.1

session state = processingActionsState

session-1

remote host = 172.31.29.5

--MORE--

session is persistent = yes

number of requests serviced on current connection = 1

last status code = 200

last request method = GET

last request URI = cgi-bin/sdee-server

last protocol version = HTTP/1.1

session state = processingActionsState

session-12

remote host = 172.31.29.5

session is persistent = yes

number of requests serviced on current connection = 1

last status code = 200

last request method = GET

last request URI = cgi-bin/sdee-server

last protocol version = HTTP/1.1

session state = processingActionsState

session-3

remote host = 172.31.29.5

session is persistent = yes

number of requests serviced on current connection = 1

last status code = 200

last request method = GET

last request URI = cgi-bin/sdee-server

last protocol version = HTTP/1.1

--MORE--

session state = processingActionsState

session-9

remote host = 172.31.29.5

session is persistent = yes

number of requests serviced on current connection = 1

last status code = 200

last request method = GET

last request URI = cgi-bin/sdee-server

last protocol version = HTTP/1.1

session state = processingActionsState

number of server session requests handled = 2473653

number of server session requests rejected = 0

total HTTP requests handled = 2476496

maximum number of session objects allowed = 40

number of idle allocated session objects = 4

number of busy allocated session objects = 9

summarized log messages

number of TCP socket failure messages logged = 0

number of TLS socket failure messages logged = 0

number of TLS protocol failure messages logged = 0

number of TLS connection failure messages logged = 56

number of TLS crypto warning messages logged = 0

number of TLS expired certificate warning messages logged = 0

number of receipt of TLS fatal alert message messages logged = 0

--MORE--

crypto library version = 6.2.1.0

Show events shows that there are events on the device in the real time.

IPS EVENTS RETRIVAL

Todd Pula — Mon, 23 Apr 2012 15:15:47 GMT

What specific log collector application is the 172.31.29.5 host? One possible workaround to avoid a reboot can be found in the release notes of the bug below:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCse68062

topic IPS EVENTS RETRIVAL in Network Security

IPS EVENTS RETRIVAL

IPS EVENTS RETRIVAL