RTMT CSA Critical Alert after upgrade to CUCM 7.1.5.34900-7

[kelvin.j.owen]

I've just upgraded our 11 server 7.1.3 CUCM cluster to CUCM 7.1.5.34900-7 which on the whole was sucessful

However, I'm now get regular one alert approximately every hour on RTMT related to CSA (see text below). Each alert  always originates from the Publisher and refers to the other servers in the cluster, though not necessarily the same server. I've re-booted the publisher, which made no difference. As far as I can tell, there is no impact, it's just a little annoying to see the alerts appear.

Anyone seen anything similar ?

I'll happily re-boot the entire cluster once more if I thought it would fix the issue, but our internal change process for a server re-boot is a pain I would like to avoid!

Dec 17 15:35:43 CUCM-PUB local4 2 : 28: CUCM-PUB: Dec 17 2012 15:35:43.429 +0000: %CSA-2-EVENT_CLIM_DENY: %[PID=4325][component=CiscoSecurityAgent] : The process '/usr/local/platform/bin/clm/clm' (as user root(0) group root(0)) attempted to establish a TCP connection with 10.10.10.12 on port 8500 and exceeded the specified rate limit of 100 connections in 1 minutes. The operation was denied. [rule 2050]

Regards

Kelvin

[Aditya Gupta · Accepted solution]

Hi Kelvin

Can you try restarting the Cluster Manager service for some your nodes for which you are getting alarms . To restart the Cluster manager service use the following command:

Utils service restart Cluster Manager

Regards

Aditya Gupta

[kelvin.j.owen]

Hi Aditya

Thanks for the response

will do - but do you know if are there any service implications to restrating this service ?  i.e does it have any ipmact on users or administration ?

Regards

Kelvin

[Aditya Gupta]

Hi Kelvin

Ideally there will be no affect on the call or devices by restarting the service. But if you still have any doubts you can perform this during the off-hours and do this initally on few server maybe 2 or 3 . Monitor them and then proceed with others.

Regards

Aditya Gupta

[kelvin.j.owen]

Hi Aditya

Yesterday I restarted Cluster Manager on all of the non-call processing servers (i.e. standy subscribers and TFTP servers) to reduce the risk of any possibile impact. As far a  I know there was no impact and since then no alerts on RTMT, so looks like it did the trick.

Thanks for your help

Regards

Kelvin

[Aditya Gupta]

Hi Kelvin

Good to know it worked