CSCvi80716 - Large number of file analysis queries can cause high memory usage and crashes for AMP
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-04-2018 12:11 AM
¿Is the following alert in WSA an effect from this bug?
The Warning message is:
The File Reputation service is not reachable.
Last message occurred 39 times between Thu Oct 4 07:03:26 2018 and Thu Oct 4 07:43:12 2018.
In our case, once a WSA gets in this state, the only workaround is to reboot the proxy. This normally gets the proxy back in operation. It could happen again in an undetermined time.
I haven't seen progress in the documentation of this case, is there any?
- Labels:
-
Cisco Bugs
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-28-2021 07:40 AM
I'm having the same problem
The Warning message is:
The File Analysis service is not reachable
Last message occurred 40 times between Wed Apr 28 09:20:50 2021 and Wed Apr 28 10:19:24 2021.
The File Reputation service is not reachable.
Last message occurred 60 times between Wed Apr 28 09:21:23 2021 and Wed Apr 28 10:20:24 2021.
Product: Cisco S100V Web Security Virtual Appliance
Model: S100V
Version: 12.5.1-043
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-05-2021 11:08 PM
Hello,
We are having the same issue. We observe the below message on WSA:
"The File Analysis service is not reachable,
Last message occurred 40 times between Sat Jul 3 14:53:23 2021 and Sat Jul 3 15:52:36 2021."
Product Information
Product: Cisco S170 Web Security Appliance
Model: S170
The telnet command to the corresponding file analysis server is working.
telnet panacea.threatgrid.com 443
I also think that it is highly unlikely firewall to block access to the destination since telnet is working..
Has anyone found a solution? I have seen some similar posts related to ESA, in which users suggested to re-register the device.
As for me, I believe that it would more wise to perform a packet capture on WSA to see what it really happens in network level.
Any advice would be highly appreciated.
Thanks in advance,
MEB
