08-24-2011 12:00 AM - edited 03-10-2019 05:27 AM
dear all,
i newly enabled global correlation on my IPS-4240. the global correlation was working fine for several days.
suddenly it is no more working, although the config is not modified.
1-mgt interface can resolve Address.
2-clock is not synchronized with ntp but it is set manually to be same as ntp server(internet)
3- no proxy used .
i disbaled /enabled global config still the same issue.
sh statistics global-correlation
Network Participation:
Counters:
Total Connection Attempts = 0
Total Connection Failures = 0
Connection Failures Since Last Success = 0
Connection History:
Updates:
Status Of Last Update Attempt = Failed
Time Since Last Successful Update = 7392 minutes
Counters:
Update Failures Since Last Success = 1478
Total Update Attempts = 3060
Total Update Failures = 1481
Update Interval In Seconds = 300
Update Server = update-manifests.ironport.com
Update Server Address = 204.15.82.17
Current Versions:
config = 0
drop = 0
ip = 0
rule = 0
please advice.
Solved! Go to Solution.
08-24-2011 02:07 AM
If there is no network changes, I would suggest that you reload the IPS and see if that resolves the issue.
If you would like to further investigate the issue, I would suggest that you open a case with TAC so it can be further investigated.
08-24-2011 12:12 AM
Pls check if there is any changes in the network infrastructure since the Global Correlation stops working.
Would need to confirm that access to update-manifests.ironport.com (204.15.82.17) is allowed through the network.
08-24-2011 01:42 AM
no network change,
plz check the following error log:
errorMessage: A global correlation update failed: Failed download of ibrs/1.1/drop/default/1314000963 : URI does not contain a valid ip address Messages, like this one, in the category - Reputation update failure - were logged 25 times in the last 7495 seconds. name=errUnclassified
08-24-2011 02:07 AM
If there is no network changes, I would suggest that you reload the IPS and see if that resolves the issue.
If you would like to further investigate the issue, I would suggest that you open a case with TAC so it can be further investigated.
09-06-2011 12:05 AM
hello jennifer,
i didn't reload the device, i was checking after couple of days the issue and i found that it was automaticaly and alone resynchronizing with global correlation site.
right it is abnormal behavior but i don't have an explanation to what happened.
regards,
09-06-2011 12:22 AM
Thanks for the update, and you might want to open a TAC case if it happens again in the future for further investigation.
09-06-2011 04:28 AM
hello jennifer,
unfortunately the problem re-occured.
could it be that the update-manifests.ironport.com (global correllation site) is not stable?
09-12-2011 09:07 AM
Hi,
We will have to probably enable logs for global correlation using the service account and see what's going on. I would suggest what jennifer suggested above, that is, open a TAC case.
Regards,
Prapanch
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide