The sensor is most likely regenerating regular expression cache tables.
Instead of analyzing each signature's regular expression independantly when a packet comes in, it will instead combine the regular expressions of all of the signatures into one giant regular expression and generate a state table, and then write the new state table to the disk/compactflash. (We term these the regular expression cache tables).
When you enable or disable a signature, or when you add in custom signatures, it will have to regenerate these cache tables, because that combined regex has now changed.
(NOTE: Version 5.0 has large improvements in this area. Cache tables are now shipped directly from Cisco for the standard unretired signatures as part of the signature update process. But if you add custom signatures or unretire signatures that Cisco has retired, then even 5.0 can take time to make the changes)
Creating these tables is very CPU intensive, so the sensor is not able to monitor traffic while the tables are being created.
So it is best to save modifications like enable/disabling, retiring/unretiring, changing regular expressions, and creating custom signatures for times when you can afford the sensor downtime.
NOTE: Modifications to severity, actions, summarizations, and filters do not affect the cache tables and should be able to be applied in a matter of seconds.
