After a re-image there will always be a period of time when the Analysis Engine is busy.
The Analysis Engine can take up to about 30 minutes on a low end sensor like the IDS-4215 to completely initialize itself.
It takes all of the regular expression signatures and will compile the regular expressions together into what you can consider one giant regular expression. It was what we call a regular expression cache file.
The creation of the regular expression cache file was speeded up as part of a bug fix in the 5.0(6) Service Pack.
So what to do:
After you do a re-image of the sensor just let it sit for 20 to 30 minutes. Then execute "iplog-status". If it tells you analaysisEngine is busy then keep waiting. It is tells you No Ip Logs are available then it is ready to go. (Any other command that queries the AnalysisEngine would work as well) This way you can also check the Analysis Engine status before going through and typing up all of the config changes.
Resetting the sensor while the Analsysis Engine is busy just prolongs the initialization, the Analysis Engine will have to redo some of the intialization.
My recommendation for versions right now is to load 5.0(1) or 5.0(2) base image. Wait for 20 to 30 minutes till Analysis Engine is responding, then load the 5.0(6) Service Pack. When you load the 5.0(6) Service Pack there will once again be a big jump in signatures so there will be another initialization period.
Once that initialization is done, then load the latest Signature Update.
As for version 5.1(1) there are some known issues that cause Analysis Engine to stop Running. Don't confuse these bugs with the standard initialization time for Analysis Engine. Analysis Engine veing busy is normal and expected after a re-image or upgrade, an Analysis Engine "Not Running" is a bug.
If you are seeing "Not Running" for Analysis Engine when executing "show version" then please contact the TAC. There is a engineering patch for some of these issues, but it does requiring running special engineering builds that are in the process of going through testing.
Cisco is working on these issues and will be releasing an official update as soon as the fixes have been fully tested at Cisco.
Until those 5.1(1) issues are addressed, your options would be to contact the TAC and possibly obtain the special engineering build, or downgrade to the 5.0(6) version as mentioned above.
