cisco ips error

[secureIT]

Hi Team,

Im getting the below error while im selecting the signatures, in cisco ips 4200 devices...

cisco ips deliver failed

unspecifiederror - / -- could not reserve space: /usr/cids/idsRoot/etc/config/signatureDefinition/instances/sig0.xml.1277737928.tm

recommend deleting unused configurations, and anomaly detection knowledge base files to restore edit capability

deliver failed
unspecifiederror - / -- could not reserve space: /usr/cids/idsRoot/etc/config/signatureDefinition/instances/sig0.xml.1277737928.tm
recommend deleting unused configurations, and anomaly detection knowledge base files to restore edit capability

can anyone help...

regards

Sec-IT

[Jennifer Halim]

what is your IPS version?

[secureIT]

ips 4240 with 7.0.2.E4

[Jennifer Halim]

how many signatures do you enable?

[secureIT]

quite a few, we noticed this error while we were trying to disable the signatures..hence its stuck up..i searched in the forums about this error and did not find any clues...

[Jennifer Halim]

base on that error message, it looks like a number of files that filled up the filesystem.

Can you please check the following directory:

/usr/cids/idsRoot/var/

and see what are in there, and see if it could possibly filled up the system. Please delete the ones that are not required.

[secureIT]

Could you pls check this...

Using 1439997952 out of 1984548864 bytes of available memory (72% usage)

system is using 17.4M out of 38.5M bytes of available disk space (45% usage)

application-data is using 166.8M out of 166.8M bytes of available disk space (100% usage) ******

boot is using 41.6M out of 68.6M bytes of available disk space (64% usage)

application-log is using 123.5M out of 513.0M bytes of available disk space (24% usage)

Filesystem                Size      Used Available Use% Mounted on

/dev/ramdisk             38.5M     17.4M     21.1M  45% /

/dev/hda2               166.8M    166.8M         0 100% /mnt/rw

/dev/hda2               166.8M    166.8M         0 100% /dev

/dev/hda2               166.8M    166.8M         0 100% /etc

/dev/hda2               166.8M    166.8M         0 100% /home

/dev/hda2               166.8M    166.8M         0 100% /usr/cids

/dev/hda2               166.8M    166.8M         0 100% /lib/modules

/dev/boot                68.6M     41.6M     23.5M  64% /boot

none                      5.0M      4.0k      5.0M   0% /tmp

none                      8.0M     56.0k      7.9M   1% /var

none                   8192.0T         0   8192.0T   0% /mnt/huge

none                    513.0M    123.5M    389.5M  24% /usr/cids/idsRoot/var/iplogs

none                    521.0M     48.0k    521.0M   0% /usr/cids/idsRoot/tmp

none                     31.0M     28.7M      2.3M  92% /usr/cids/idsRoot/var/eventStore

[Jennifer Halim]

You would need to delete some files that might be keeping the disk space.

Can you please log in through CLI using service account, and check the "/usr/cids/idsRoot/var" directory

If you haven't got a service account, you can create one:

http://www.cisco.com/en/US/docs/security/ips/6.2/configuration/guide/cli/cli_troubleshooti
ng.html#wp1008176

Once you are in:

ls -al /usr/cids/idsRoot/var/