topic Re: IDS sensor and MC update in Network Security

IDS sensor and MC update

o.oresotu — Sun, 10 Mar 2019 09:14:21 GMT

Hi,

My organisation uses a Cisco IDS 4215 which i always update from ciscoworks VMS 1.0.3. However, on applying the last update (IDS-sig.4.1.4-S137), it only update the sensor but failed to update the MC. Futhermore, when i telnet to the sensor i could login but there is an error "can not communicate with processes system halted"

Can anyone give me a clue on how wo resolve this problems?.

Re: IDS sensor and MC update

nkhawaja — Sat, 22 Jan 2005 01:54:18 GMT

have you tried rebooting the sensor? try that and then on idsmc click on "query sensor"

thanks

Nadeem

Re: IDS sensor and MC update

o.oresotu — Tue, 25 Jan 2005 09:13:56 GMT

Hi,

Although i've restarted the sensor before now, i've equally done that again. the situation still remains the same i.e. sensor is being upgraded while MC is not.

Re: IDS sensor and MC update

sachinraja — Tue, 25 Jan 2005 09:37:39 GMT

try restarting the ciscoworks daemon manager service on your VMS server. make sure you start all service back. hope you have placed the zip file on the correct folder :

c:/programfiles/cscopx/mdc/etc/ids/updates.

Raj

Re: IDS sensor and MC update

o.oresotu — Tue, 25 Jan 2005 12:11:18 GMT

Hi Raj,

I've restarted the services and yet the problem still persist. Yes, the zip file is in the correct folder.

Segun

Re: IDS sensor and MC update

5mlattimore — Mon, 31 Jan 2005 23:09:01 GMT

I read on a post here that there is a 4.1.4(f) patch that corrects an out of memory condition.

Ive seen this many times but it usually responds to a reboot of the sensor

Once I also had to reboot the IDS MC to get it to recognize that the sensor had been updated

good lucj

Re: IDS sensor and MC update

o.oresotu — Wed, 02 Feb 2005 12:30:26 GMT

Hi 5mlattimore,

Are you saying this is an out of memory problem. If so can u direct me to the url for the patch 4.1.4(f).

Regards

Re: IDS sensor and MC update

craiwill — Wed, 02 Feb 2005 15:44:07 GMT

If you are not running the 'f' patch , 4.1.4(f), you should download and install that patch. It fixes some out-of-memory on upgrade issues that are most likely the cause of your problem.

http://www.cisco.com/cgi-bin/tablebuild.pl/ids-patches

Re: IDS sensor and MC update

o.oresotu — Wed, 02 Feb 2005 17:27:49 GMT

Hi Craiwill,

Thank you for the information. I realise i have not applied any of the patches (a,b,c,d,e,f). Do i have to start from 'a' or i should i just apply 'f'.I mean is it cumulative?

Thanks

Re: IDS sensor and MC update

craiwill — Wed, 02 Feb 2005 19:11:30 GMT

The patches are cumulative and can be applied to any sensor 4.1(4)S91 or later.

Re: IDS sensor and MC update

nkhawaja — Wed, 02 Feb 2005 20:41:20 GMT

if ou run audit log report, you will see some error messages there, usually it happens due to certificate expires on MC. in that case you need to regenerate the certificate.

Re: IDS sensor and MC update

o.oresotu — Thu, 03 Feb 2005 06:51:26 GMT

Hi nkhawaja,

The audit log has the ff errors but does not report anything on MC certificate expiration:

error 1)RDEP Collector (HQ-IDS-01) parsed an evError: errSyslog lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory

error 2)RDEP Collector (HQ-IDS-01) parsed an evError: errTransport WebSession::sessionTask(0) TLS connection exception: handshake incomplete.

error 3)RDEP Collector Client RuntimeException :HQ-IDS-01- HTTP connection failed [1,0]

error 4) The update of sensor HQ-IDS-01 was stopped because the MC could not determine the actual version of the sensor.(Communication error)

error 5) HQ-IDS-01.OrganizationName: Error importing sensor version from the sensor - Aborting the CLI command because it has not responded in over 0 hours 30 minutes 10 seconds

Re: IDS sensor and MC update

nkhawaja — Thu, 03 Feb 2005 18:17:01 GMT

can you try to remove the sensor from IDSMC and add it again (using auto discover settings)..

can you run mdcsupport.exe and attach the file mdcsupportinformation.zip (or send it to me may be i can find something out)

thanks

Re: IDS sensor and MC update

o.oresotu — Fri, 04 Feb 2005 14:26:39 GMT

where on the MC is the auto discovery setting? Also, the mdcsupport.exe is not available on the sensor?

thanks

Re: IDS sensor and MC update

o.oresotu — Tue, 08 Feb 2005 07:53:48 GMT

The patch (f) hung the sensor. i had to restart it. How can i run the mdcsupport.exe?. where exactly is this exe file?.

Thanks

Re: IDS sensor and MC update

nkhawaja — Tue, 08 Feb 2005 17:35:19 GMT

mdcsupport.exe you can run from any directory on the VMS server.

thanks

Re: IDS sensor and MC update

o.oresotu — Wed, 09 Feb 2005 07:50:32 GMT

Hi nkhawaja,

Thank you for information. Please find attached the mdcsupport.zip file.

Thanks

Re: IDS sensor and MC update

nkhawaja — Wed, 09 Feb 2005 23:40:52 GMT

i dont think this is an issue with your VMS server, i checked the log file and it seems like the issue is with the sensor.

try to manually upgrading the sensor and see if that works, if that works then delete the sensor from the VMS, add it again using auto discover settings and then apply the new signature update.

Re: IDS sensor and MC update

o.oresotu — Thu, 10 Feb 2005 06:20:04 GMT

Hi nkhawaja,

Please where on the VMS can i see the auto discover settings?

Thanks

Re: IDS sensor and MC update

nkhawaja — Thu, 10 Feb 2005 18:28:33 GMT

when you are addding the sensor, there is a check box there to discover the setting of the sensor