i newly enabled global correlation on my IPS-4240. the global correlation was working fine for several days.
suddenly it is no more working, although the config is not modified.
1-mgt interface can resolve Address.
2-clock is not synchronized with ntp but it is set manually to be same as ntp server(internet)
3- no proxy used .
i disbaled /enabled global config still the same issue.
sh statistics global-correlation
Total Connection Attempts = 0
Total Connection Failures = 0
Connection Failures Since Last Success = 0
Status Of Last Update Attempt = Failed
Time Since Last Successful Update = 7392 minutes
Update Failures Since Last Success = 1478
Total Update Attempts = 3060
Total Update Failures = 1481
Update Interval In Seconds = 300
Update Server = update-manifests.ironport.com
Update Server Address = 220.127.116.11
config = 0
drop = 0
ip = 0
rule = 0
Solved! Go to Solution.
Pls check if there is any changes in the network infrastructure since the Global Correlation stops working.
Would need to confirm that access to update-manifests.ironport.com (18.104.22.168) is allowed through the network.
no network change,
plz check the following error log:
errorMessage: A global correlation update failed: Failed download of ibrs/1.1/drop/default/1314000963 : URI does not contain a valid ip address Messages, like this one, in the category - Reputation update failure - were logged 25 times in the last 7495 seconds. name=errUnclassified
i didn't reload the device, i was checking after couple of days the issue and i found that it was automaticaly and alone resynchronizing with global correlation site.
right it is abnormal behavior but i don't have an explanation to what happened.
unfortunately the problem re-occured.
could it be that the update-manifests.ironport.com (global correllation site) is not stable?
We will have to probably enable logs for global correlation using the service account and see what's going on. I would suggest what jennifer suggested above, that is, open a TAC case.