Hi Team,
Im getting the below error while im selecting the signatures, in cisco ips 4200 devices...
cisco ips deliver failed
unspecifiederror - / -- could not reserve space: /usr/cids/idsRoot/etc/config/signatureDefinition/instances/sig0.xml.1277737928.tm
recommend deleting unused configurations, and anomaly detection knowledge base files to restore edit capability
deliver failed
unspecifiederror - / -- could not reserve space: /usr/cids/idsRoot/etc/config/signatureDefinition/instances/sig0.xml.1277737928.tm
recommend deleting unused configurations, and anomaly detection knowledge base files to restore edit capability
can anyone help...
regards
Sec-IT
what is your IPS version?
ips 4240 with 7.0.2.E4
how many signatures do you enable?
quite a few, we noticed this error while we were trying to disable the signatures..hence its stuck up..i searched in the forums about this error and did not find any clues...
base on that error message, it looks like a number of files that filled up the filesystem.
Can you please check the following directory:
/usr/cids/idsRoot/var/
and see what are in there, and see if it could possibly filled up the system. Please delete the ones that are not required.
Could you pls check this...
Using 1439997952 out of 1984548864 bytes of available memory (72% usage)
system is using 17.4M out of 38.5M bytes of available disk space (45% usage)
application-data is using 166.8M out of 166.8M bytes of available disk space (100% usage) ******
boot is using 41.6M out of 68.6M bytes of available disk space (64% usage)
application-log is using 123.5M out of 513.0M bytes of available disk space (24% usage)
Filesystem Size Used Available Use% Mounted on
/dev/ramdisk 38.5M 17.4M 21.1M 45% /
/dev/hda2 166.8M 166.8M 0 100% /mnt/rw
/dev/hda2 166.8M 166.8M 0 100% /dev
/dev/hda2 166.8M 166.8M 0 100% /etc
/dev/hda2 166.8M 166.8M 0 100% /home
/dev/hda2 166.8M 166.8M 0 100% /usr/cids
/dev/hda2 166.8M 166.8M 0 100% /lib/modules
/dev/boot 68.6M 41.6M 23.5M 64% /boot
none 5.0M 4.0k 5.0M 0% /tmp
none 8.0M 56.0k 7.9M 1% /var
none 8192.0T 0 8192.0T 0% /mnt/huge
none 513.0M 123.5M 389.5M 24% /usr/cids/idsRoot/var/iplogs
none 521.0M 48.0k 521.0M 0% /usr/cids/idsRoot/tmp
none 31.0M 28.7M 2.3M 92% /usr/cids/idsRoot/var/eventStore
You would need to delete some files that might be keeping the disk space.
Can you please log in through CLI using service account, and check the "/usr/cids/idsRoot/var" directory
If you haven't got a service account, you can create one:
http://www.cisco.com/en/US/docs/security/ips/6.2/configuration/guide/cli/cli_troubleshooti
ng.html#wp1008176
Once you are in:
ls -al /usr/cids/idsRoot/var/