If you look in the output of show version you see "NotRunning" for AnalysisEngine. This means the sensorApp process has stopped for some reason.
What to do:
1) Reboot the sensor to get everything running again.
2) Use show version to verify that AnalysisEngine is Running.
NOTE:
If AnalysisEngine is NotRunning then don't even bother with the sig update it will fail. the AnalysisEngine has to be running for the sig update install.
The TAC would need to be contacted to help troubleshoot further in that situation.
If AnalysisEngine is not running right after a reboot then something in the configuration or another file on the box may be a problem. You might have to execute "conf t" and then "recover application-partition" to re-image the sensor and start from scratch again (the TAC should walk you through it if necessary).
3) Attempt to install the sig update again.
Hopefully it installed just fine this time.
If so then the previous error had nothing to do with the sig update install instead the AnalysisEngine was probably having a problem even before you tried the update.
You will need to keep a watch on this sensor to see if AnalysisEngine stops running again. If so then contact the TAC so they get a core file and pass it on for development to analyze. They may have you load a 4.1(4g) engineering patch that contains some additional fixes.
If the install errors then go to step 4.
4) Check the output of "show version" again if you get the same error.
If AnalysisEngine was Running just before the install but is NotRunning just after the install then you may be running across a known issue that was addressed in the 4.1(4g) engineering patch. Contact the TAC to get the patch.
If AnalysisEngine is still Running after the install failure, then this could just be a normal situation where the AnalysisEngine was busy and not ready to be updated. This is perfectly normal after a reboot.
Wait a few minutes, and start with step 3 above one more time.
You may have to wait as much as 25 minutes (on low end platforms) for AnalysisEngine to be ready. These situations are rare, and are generally only seen on a fresh image of the sensor where the AnalysisEngine has to prepare a lot of cache files, or where a large number of signature updates have been skipped (like jumping from S91 to S155) which will cause a lot of cache files needing to be created for all of the new signatures.
So if it doesn't work the 2nd time and AnalysisEngine is still Running, then wait 30 minutes and try again. You might be running into one of those rare ocurrences.
If AnalysisEngine stays running but you still can't get the sig update installed even after waiting 30 minutes, then something weird is going on.
You will need to supply the TAC with a system status report from the sensor (a show techsupport).
