CSCvi80716 - Large number of file analysis queries can cause high memory usage and crashes for AMP

[jmdavila]

¿Is the following alert in WSA an effect from this bug?

The Warning message is:

The File Reputation service is not reachable.

Last message occurred 39 times between Thu Oct  4 07:03:26 2018 and Thu Oct  4 07:43:12 2018.

In our case, once a WSA gets in this state, the only workaround is to reboot the proxy. This normally gets the proxy back in operation. It could happen again in an undetermined time.

I haven't seen progress in the documentation of this case, is there any?

[djoseph18]

I'm having the same problem

The Warning message is:

 The File Analysis service is not reachable

Last message occurred 40 times between Wed Apr 28 09:20:50 2021 and Wed Apr 28 10:19:24 2021.

 The File Reputation service is not reachable.

Last message occurred 60 times between Wed Apr 28 09:21:23 2021 and Wed Apr 28 10:20:24 2021.

Product: Cisco S100V Web Security Virtual Appliance

Model: S100V

Version: 12.5.1-043

[spacemeb]

Hello,

We are having the same issue.  We observe the below message on WSA:

"The File Analysis service is not reachable,

Last message occurred 40 times between Sat Jul  3 14:53:23 2021 and Sat Jul  3 15:52:36 2021."

Product Information

Product: Cisco S170 Web Security Appliance
Model: S170

The telnet command to the corresponding file analysis server is working.

 telnet panacea.threatgrid.com 443

 I also think that it is highly unlikely firewall to block access to the destination since telnet is working..

Has anyone found a solution? I have seen some similar posts related to ESA, in which users suggested to re-register the device. 

As for me, I believe that it would more wise to perform a packet capture on WSA to see what it really happens in network level. 

Any advice would be highly appreciated.

Thanks in advance,

MEB