errSystemError-ct-sensorApp.429 not responding

[HCL Support]

We got following error message when login into IPS over IDM after updated below given signature.

 Error: errSystemError-ct-sensorApp.429 not responding

IPS-sig-S891-req-E4.pkg

 IPS version: 

IPS 4260 VER 7.0(4)E4

Please assist to resolve the issue

[Akshay Rastogi]

Hi HCL Support,

it looks like that the sensorapp/ analysis engine is not up yet after the signature update. Are you still not able to access it yet. You should have got the access by now.

Have you tried taking the ssh access on management IP of the appliance? could you please share the output of that?

If you still doesn't got the access then reload may be required.

If possible for you, you could upgrade your appliance to version 7.1(10)e4 as 7.0.4 might be having a lot of caveats as well.

Regards,

Akshay Rastogi

[HCL Support]

hi Akshay, 

Other IPS is working fine with same version and same signature. We have reloaded same but not issue is persisting still..

Pleas find the attached file of working IPS.

And go though the below output of show version and show health of  not working IPS and suggest: 

Output from show version
Application Partition:

Cisco Intrusion Prevention System, Version 7.0(4)E4

Host:
Realm Keys key1.0
Signature Definition:
Signature Update S891.0 2015-10-20
OS Version: 2.4.30-IDS-smp-bigphys
Platform: IPS-4260-K9
Serial Number: FTX14375037
Licensed, expires: 18-Nov-2015 UTC
Sensor up-time is 138 days.
Using 1911123968 out of 4100345856 bytes of available memory (46% usage)
system is using 17.4M out of 38.5M bytes of available disk space (45% usage)
application-data is using 52.1M out of 166.8M bytes of available disk space (33% usage)
boot is using 41.6M out of 68.6M bytes of available disk space (64% usage)
application-log is using 494.0M out of 513.0M bytes of available disk space (96% usage)


MainApp B-BEAU_704_2010_JUL_21_15_57_7_0_3_29 (Ipsbuild) 2010-07-21T15:59:36-0500 Running
AnalysisEngine B-BEAU_704_2010_JUL_21_15_57_7_0_3_29 (Ipsbuild) 2010-07-21T15:59:36-0500 NotRunning
CollaborationApp B-BEAU_704_2010_JUL_21_15_57_7_0_3_29 (Ipsbuild) 2010-07-21T15:59:36-0500 Running
CLI B-BEAU_704_2010_JUL_21_15_57_7_0_3_29 (Ipsbuild) 2010-07-21T15:59:36-0500

Upgrade History:

* IPS-sig-S886-req-E4 10:41:38 UTC Wed Sep 23 2015
IPS-sig-S891-req-E4.pkg 13:39:25 UTC Tue Oct 27 2015

Recovery Partition Version 1.1 - 7.0(4)E4

Host Certificate Valid from: 03-Feb-2011 to 03-Feb-2013

Output from show health
Overall Health Status Red
Health Status for Failed Applications Red
Health Status for Signature Updates Green
Health Status for License Key Expiration Yellow
Health Status for Running in Bypass Mode Red
Health Status for Interfaces Being Down Not Enabled
Health Status for the Inspection Load Green
Health Status for the Time Since Last Event Retrieval Green
Health Status for the Number of Missed Packets Green
Health Status for the Memory Usage Green
Health Status for Global Correlation Not Enabled
Health Status for Network Participation Not Enabled

Security Status for Virtual Sensor vs0 Green

[Akshay Rastogi]

Hi HCL Support,

As mentioned earlier, analysis engine is not working. Your working one is having s886 signature version while your non-working upgraded to version s891.

You could reset the module once with 'reset' command in the sensor. Do not inclide the powerdown option mentioned in the below link :

http://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/cli/cliguide7/cli_administration.html#wp1031096

Also host certificate is expired as well.  Generate the host certificate with below command :

- #tls generate-key

If wish to further investigate, please open a tac case. They would check logs if there is any defect or something matching.

Regards,

Akshay Rastogi