07-01-2011 12:14 PM - edited 03-10-2019 05:23 AM
Hello,
I have a strange error on my IPS, and can’t find reason.
Analysis Engine is Busy Processing Stage 3 of 97 at Step 0 of 1
Messages, like this one, in the category - ct to sensorApp timed out - were logged 1 times in the last 0 seconds. name=errUnclassified
It is installed on ASA 5510, and operating in testing environment under low load. There are about 250 signatures active what can be problem ?
07-01-2011 12:33 PM
Hi,
Can you give me the brief idea about which IPs version is there previous and when you upgrade the new version?
Also try to login first thru ASA and check the module and then try to login thru cli.if it is working with CLI then you have to check which GUI version (IDM) you are using.Please give me the details.
Rajeswar.
07-01-2011 01:11 PM
Thank you for helping.
The error message shown above is periodically generated in Events store. Actually I can log in and manage device.
This is device details.
ASA 5500 Series Security Services Module-10
Model: ASA-SSM-10
Hardware version: 1.0
Firmware version: 1.0(11)5
Software version: 7.0(5)E4
App. name: IPS
App. Status: Up
App. Status Desc:
App. version: 7.0(5)E4
Data plane Status: Up
Status: Up
Mgmt web ports: 443
Mgmt TLS enabled: true
IDM 7.0(5)
The previous version was generating same error so I upgrade it. Then it was quiet for some time but now it started again. Sorry I don’t remember exactly which was previous version.(It was somewhat E3)
Also there are 2 ASA in failover.
07-05-2011 10:35 AM
Please try to find which version previously you used! and beeter do one thing fresh IOS you can load i mean delete all previous version IOS and upload Latest version lets see!!!!
Before doing that take backup.(all imean ios,idm,config).
Rajeswar.
07-05-2011 11:32 AM
Hello ngtransge,
It's probably best to look at this through a TAC case. We'll need a "show tech" from your sensor and a timestamp for when this error occurred.
Thank you,
Blayne Dreier
Cisco TAC Escalation Team
**Please check out our Podcasts**
TAC Security Show: http://www.cisco.com/go/tacsecuritypodcast
TAC IPS Media Series: https://supportforums.cisco.com/docs/DOC-12758
07-06-2011 10:50 AM
Thank you for helping.
As i sad devices were in failover, and the same logs were generated on standby.
Here are logs from standby:
evError: eventId=1305469802414936299 vendor=Cisco severity=error
originator:
hostId: sensor
appName: mainApp
appInstanceId: 409
time: May 18, 2011 11:09:53 UTC offset=240 timeZone=GMT+04:00
errorMessage: Error - accept() call returned -1 name=errUnclassified
evError: eventId=1305469802414936303 vendor=Cisco severity=error
originator:
hostId: sensor
appName: cidwebserver
appInstanceId: 428
time: May 18, 2011 11:10:04 UTC offset=240 timeZone=GMT+04:00
errorMessage: connect timed out [ClientPipe::connect] name=errSystemError
evError: eventId=1305469802414936304 vendor=Cisco severity=error
originator:
hostId: sensor
appName: cidwebserver
appInstanceId: 428
time: May 18, 2011 11:10:04 UTC offset=240 timeZone=GMT+04:00
errorMessage: - ct-mainApp.360 not responding, please check system processes - The connect to the specified Io::ClientPipe failed. name=errSystemError
evError: eventId=1305476622414932019 vendor=Cisco severity=error
originator:
hostId: sensor
appName: collaborationApp
appInstanceId: 496
time: Jun 28, 2011 11:32:05 UTC offset=240 timeZone=GMT+04:00
errorMessage: Analysis Engine is Busy Processing Stage 3 of 97 at Step 0 of 1
Messages, like this one, in the category - ct to sensorApp timed out - were logged 1 times in the last 0 seconds. name=errUnclassified
I will try to reimage it with IPS-SSM_10-K9-sys-1.1-a-7.0-5a-E4.img.
If it won't help then maybe i will contact TAC.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide