ASA IPS SSM-10

[aguia05]

After upgrade my ASA IPS sensor to version 7.1(6)E4 I receive this two Alerts every hour:

<161>Sep 19 2012 21:23:09: %ASA-1-505013: ASA-SSM-10 Module in slot 1, application reloading "IPS", version "7.1(6)E4" Config Change

<161>Sep 19 2012 21:23:09: %ASA-1-505015: ASA-SSM-10 Module in slot 1, application up "IPS", version "7.1(6)E4" Normal Operation

ASA version is 8.4(4)1

I reload de sensor, same results.

Any idea? Is safe to ignore this two message?

Thanks

[order]

I upgraded mine yesterday and am seeing these messages too - once per hour.  My sensor is setup to check for signature updates every six hours - so it's not that.  I also thought it might be related to the Global Correlation updates -  but one occurred just two minutes ago and the sensor did't reload.  The alerts are 505015 (resuming normal operation) and 505013 (Config Change).  In the past when I've seen messages miscategorized - I'll change them within the ASA to be either Info or Notification. 

I will open a TAC request now.  Could be a bug and we'll need to suppress the messages (505015 and 505013) until the update is available.

[order]

Cisco TAC reports this is normal behavior and Global Correlation updates are attempted every five minutes. 

The error messages above are cosmetic - according to the TAC.  However - two defects are currently filed related to them and will be addressed moving forward.  They are as follows:

CSCts98836 (ASA: IPS Module Triggers 505013 Syslog Message but Format is  Not Correct)

CSCub28854 (Doc - IDS: application reloading "IPS" Message Needs Documentation)

If you wnat to track the defects - you will need a Smartnet.

As for me - I plan to change the severity of these messages on the ASA from Alerts to Notifications.  Once the bug is fixed - I will restore the defaults if appropriate. 

Hope this helps.

[aguia05]

Hello Michael

I received the same response from TAC. I will disable this two messages for now until the problem is fixed

Thanks all

[rsmith]

Thanks for Posting, I had the same issue and this helped track it down quickly. (ours went from 1 hour this weekend to 30 minutes this morning, to every 4 minutes in the last hour!) I just set these messages to "Informational" so I don't get any more alerts on this.

Kind of getting tired of these "cosmetic" bugs every time we upgrade, (CPU utilization at 1000%+ was a cute one!)