topic Re: Strange status event in Network Security

Strange status event

johan.kellerman — Sun, 10 Mar 2019 11:52:05 GMT

We get a lot ( approximately 10 / minute) of the following message in the status event log for an IDSM-2:

evStatus: eventId=1245875406575241648 vendor=Cisco
originator:
    hostId: hostX
    appName: modprobe
    appInstanceId:
time: dec 09, 2009 08:51:21 UTC offset=60 timeZone=UTC
syslogMessage:
    description: Note: /etc/modules.conf is more recent than /lib/modules/2.4.30-IDS-smp-bigphys/modules.dep

What does this message indicate and how can we correct this?

Johan

Re: Strange status event

rhermes — Thu, 28 Jan 2010 16:09:12 GMT

You don;t say what version of IPS software your running, but a similar (if not the same) problem was persent in versions prior to E3.

The fix was to upgrade to E3. The work around was to disable two signatures.

Here is the thread:

https://supportforums.cisco.com/message/958310#958310

- Bob

Re: Strange status event

johan.kellerman — Thu, 25 Feb 2010 14:05:36 GMT

Got an answer from TAC that solved the problem:

1) create a service account on the IDSM.
idsm(config)# username service privilege service password (your pwd)
2) exit and login with that user
3) Assume root by typing "su -"; password is the same as above
4) run depmod -a
5) Reload the module

Johan Kellerman