Cisco IDSM Event Viewer - Understanding Event ID

[Ramraj Sivagnanam Sivajanam]

Hi Everyone

Attached in this discussion is a screen shot of the Event Viewer. Just to inquire, I see a lof of these message e.g. TIPC: Lost contact with, TIPC: Lost link etc.

Is this a problem? These error messages comes with Event ID, but I'm unable to find the meaning of the Event ID. Can someone advice me please.

Thank you

Regards,

Ram

[mkodali]

TIPC messages are communications between the IPS module and the main Chassis. Looks like there are some issues in the communication which may go away after you reset the device. As for the eventID, any event or alert that is generated on the sensor will be assigned a unique ID. This is called the eventID and is used to correlate the summary alerts vs First alerts, Log events to alert events, etc.

Hope this helps

Madhu

[Ramraj Sivagnanam Sivajanam]

Hi Madhu

Thank you veyr much for your feedback. Just to understand this better, what you're saying is that the automatically generated eventID (which is a unique ID) is not an ID which I can go to Cisco website to look for its' meaning? Am i right to say this?

Regards,

Ram

[mkodali]

That is right. It is auto generated by the sensor and has no meaning.

Madhu

[Ramraj Sivagnanam Sivajanam]

Hi Madhu

Thanks for your explanation. Just one last question, if i were to see these TIPC error messages in the near future, the only thing I can do is to reboot the chassis? Is there a cisco document that explains this TIPC error, indicates what problem, possible cause and solution?

[mkodali · Accepted solution]

Hi Ramraj,

         I was talking about resetting the IPS module and not the main chassis. Those messages maybe actually benign and may not need any action on your part. In the later versions of sensor those have been throttled from the log so they are not seen at all.

Madhu