cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

1298
Views
0
Helpful
7
Replies
Highlighted
Beginner

Global Correlation Error

dear all,

i newly enabled global correlation on my IPS-4240. the global correlation was working fine for several days.

suddenly it is no more working, although the config is not modified.

1-mgt interface can resolve Address.

2-clock is not synchronized with ntp but it is set manually to be same as ntp server(internet)

3- no proxy used .

i disbaled /enabled global config still the same issue.

sh statistics global-correlation

Network Participation:

   Counters:

      Total Connection Attempts = 0

      Total Connection Failures = 0

      Connection Failures Since Last Success = 0

   Connection History:

Updates:

   Status Of Last Update Attempt = Failed

   Time Since Last Successful Update = 7392 minutes

   Counters:

      Update Failures Since Last Success = 1478

      Total Update Attempts = 3060

      Total Update Failures = 1481

   Update Interval In Seconds = 300

   Update Server = update-manifests.ironport.com

   Update Server Address = 204.15.82.17

   Current Versions:

      config = 0

      drop = 0

      ip = 0

      rule = 0

please advice.

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Cisco Employee

Global Correlation Error

If there is no network changes, I would suggest that you reload the IPS and see if that resolves the issue.

If you would like to further investigate the issue, I would suggest that you open a case with TAC so it can be further investigated.

View solution in original post

7 REPLIES 7
Highlighted
Cisco Employee

Global Correlation Error

Pls check if there is any changes in the network infrastructure since the Global Correlation stops working.

Would need to confirm that access to update-manifests.ironport.com (204.15.82.17) is allowed through the network.

Highlighted
Beginner

Global Correlation Error

no network change,

plz check the following error log:

errorMessage: A global correlation update failed: Failed download of ibrs/1.1/drop/default/1314000963 : URI does not contain a valid ip address Messages, like this one, in the category - Reputation update failure - were logged 25 times in the last 7495 seconds.  name=errUnclassified

Highlighted
Cisco Employee

Global Correlation Error

If there is no network changes, I would suggest that you reload the IPS and see if that resolves the issue.

If you would like to further investigate the issue, I would suggest that you open a case with TAC so it can be further investigated.

View solution in original post

Highlighted
Beginner

Global Correlation Error

hello jennifer,

i didn't reload the device, i was checking after couple of days the issue and i found that it was automaticaly and alone resynchronizing with global correlation site.

right it is abnormal behavior but i don't have an explanation to what happened.

regards,

Highlighted
Cisco Employee

Global Correlation Error

Thanks for the update, and you might want to open a TAC case if it happens again in the future for further investigation.

Highlighted
Beginner

Global Correlation Error

hello jennifer,

unfortunately the problem re-occured.

could it be that the update-manifests.ironport.com (global correllation site) is not stable?

Highlighted
Cisco Employee

Global Correlation Error

Hi,

We will have to probably enable logs for global correlation using the service account and see what's going on. I would suggest what jennifer suggested above, that is, open a TAC case.

Regards,

Prapanch