IPS 4240 software 6.2(3)E4

Maxim Zimovets — Sun, 10 Mar 2019 12:14:23 GMT

Hello!

I have a sensor IPS-4240 which holds IPS software 6.2(3)E4. Right now we havn't got a license.

With the device wh have almost 100% cpu usage all the time:

show statistics host

General Statistics
   Last Change To Host Config (UTC) = 27-Dec-2010 14:51:19
   Command Control Port Device = Management0/0
Network Statistics
:
:
Memory Usage
   usedBytes = 1426128896
   freeBytes = 558419968
   totalBytes = 1984548864
Summertime Statistics
   start = 02:00:00 UTC Sun Mar 27 2011
   end = 03:00:00 UTC Sun Oct 30 2011
CPU Statistics
   Usage over last 5 seconds = 100
   Usage over last minute = 100
   Usage over last 5 minutes = 100
Memory Statistics
   Memory usage (bytes) = 1426128896
   Memory free (bytes) = 558419968

From service accont I see that only one process eats CPU - mainApp.

I even created addition virtual sensor vs1 where I have disabled all signatures. It gave me no result.

Situation can be changed for a while after the sensor's reboot, but not for long time.

show interfaces doesn't show a lot of input traffic too.

Event log contains only following warnings:

evError: eventId=1293461883161643337 severity=warning vendor=Cisco
originator:
    hostId: XXXXXX
    appName: notification
    appInstanceId: 409
time: 2011/01/19 15:22:56 2011/01/19 21:22:56 GMT+06:00
errorMessage: name=errWarning - the subscription lost data [IdsEventStore::readSubscription()]

What can be a problem? How can I reduce CPU usage?

With hope to resolve the issue

Re: IPS 4240 software 6.2(3)E4

Jennifer Halim — Mon, 24 Jan 2011 08:18:06 GMT

It would be difficult to pin point what the exact issue is with the high CPU just by the information provided in the post. It seems that the mainApp is causing the high CPU, however, it is worth investigating further. I would suggest that you log a Cisco TAC case so further investigation can be performed.

Alternatively, you can try to upgrade the software to the latest version of 7.0.4(E4) which has engine improvement.

Re: IPS 4240 software 6.2(3)E4

Maxim Zimovets — Mon, 24 Jan 2011 10:51:06 GMT

Hi!

Thank you for reply. I already have oped the request. Let's see what results be.

With best regards

topic Re: IPS 4240 software 6.2(3)E4 in Network Security

IPS 4240 software 6.2(3)E4

Re: IPS 4240 software 6.2(3)E4

Re: IPS 4240 software 6.2(3)E4