ASA-SSM-10 7.0(5)E4 Error

[ngtransge]

Hello,

I have a strange error on my IPS, and can’t find reason.

Analysis Engine is Busy Processing Stage 3 of 97 at Step 0 of 1

Messages, like this one, in the category - ct to sensorApp timed out - were logged 1 times in the last 0 seconds.  name=errUnclassified

It is installed on ASA 5510, and operating in testing environment under low load. There are about 250 signatures active what can be problem ?

[haivrajesh]

Hi,

Can you give me the brief idea about which  IPs version is there previous and when you upgrade the new version?

Also try to login first thru ASA and check the module and then try to login thru cli.if it is working with CLI then you have to check which GUI version (IDM) you are using.Please give me the details.

Rajeswar.

[ngtransge]

Thank you for helping.

The error message shown above is periodically generated in Events store. Actually I can log in and manage device.

This is device details.

ASA 5500 Series Security Services Module-10

Model:              ASA-SSM-10

Hardware version:   1.0

Firmware version:   1.0(11)5

Software version:   7.0(5)E4

App. name:          IPS

App. Status:        Up

App. Status Desc:  

App. version:       7.0(5)E4

Data plane Status:  Up

Status:             Up                                               

Mgmt web ports:     443                                                        

Mgmt TLS enabled:   true 

IDM 7.0(5) 

The previous version was generating same error so I upgrade it. Then it was quiet for some time but now it started again. Sorry I don’t remember exactly which was previous version.(It was somewhat E3)

Also there are 2 ASA in failover.

[haivrajesh]

Please try to find which version previously you used! and beeter do one thing fresh IOS you can load i mean delete all previous version IOS and upload Latest version lets see!!!!

Before doing that take backup.(all imean ios,idm,config).

Rajeswar.

[Christopher Dreier]

Hello ngtransge,

It's probably best to look at this through a TAC case. We'll need a "show tech" from your sensor and a timestamp for when this error occurred.

Thank you,

Blayne Dreier

Cisco TAC Escalation Team

**Please check out our Podcasts**

TAC Security Show: http://www.cisco.com/go/tacsecuritypodcast

TAC IPS Media Series: https://supportforums.cisco.com/docs/DOC-12758

[ngtransge]

Thank you for helping.

As i sad devices were in failover, and the same logs were generated on standby.

Here are logs from standby:

evError: eventId=1305469802414936299  vendor=Cisco  severity=error 

  originator:  

    hostId: sensor 

    appName: mainApp 

    appInstanceId: 409 

  time: May 18, 2011 11:09:53 UTC  offset=240  timeZone=GMT+04:00 

  errorMessage: Error - accept() call returned -1  name=errUnclassified 

evError: eventId=1305469802414936303  vendor=Cisco  severity=error 

  originator:  

    hostId: sensor 

    appName: cidwebserver 

    appInstanceId: 428 

  time: May 18, 2011 11:10:04 UTC  offset=240  timeZone=GMT+04:00 

  errorMessage: connect timed out [ClientPipe::connect]  name=errSystemError 

evError: eventId=1305469802414936304  vendor=Cisco  severity=error 

  originator:  

    hostId: sensor 

    appName: cidwebserver 

    appInstanceId: 428 

  time: May 18, 2011 11:10:04 UTC  offset=240  timeZone=GMT+04:00 

  errorMessage: - ct-mainApp.360 not responding, please check system processes - The connect to the specified Io::ClientPipe failed.  name=errSystemError 

evError: eventId=1305476622414932019  vendor=Cisco  severity=error 

  originator:  

    hostId: sensor 

    appName: collaborationApp 

    appInstanceId: 496 

  time: Jun 28, 2011 11:32:05 UTC  offset=240  timeZone=GMT+04:00 

  errorMessage: Analysis Engine is Busy Processing Stage 3 of 97 at Step 0 of 1

Messages, like this one, in the category - ct to sensorApp timed out - were logged 1 times in the last 0 seconds.  name=errUnclassified 

I will try to reimage it with IPS-SSM_10-K9-sys-1.1-a-7.0-5a-E4.img.

If it won't help then maybe i will contact TAC.