Working with an ASA5555-IPS, running ver: 7.1(6)E4, latest sigs, doing some initial testing.
I created a custom signature in the default sig0 to do some testing. sig id was 60000.
I then "disabled" it in the IME and hit apply, took a few seconds, double checked the list, and the signature was now listed as disabled.
Did testing again, and this disabled signature was still triggering.
Then I retired it, hit apply.
Did testing again, and this now disabled and retired signature was still triggering.
Now I deleted the signature.
Testing, still triggering.
Now I made a new signature with same sig id.
Testing, still triggering old signature.
The only way I could make this stop, was to reboot the sensor.
Is there a signature cache or something like that? Is there a way to clear it, or rebuild it on demand?
