interface bouncing after S219 install on 4250 IDS/4.1

[jchrisos]

I installed the S219 updates on one of our client's IDSes. After the install, the eth0 (sniffing) interface started bouncing. I'm getting the following errors constantly (i.e. 2300 in 2 hours)

evError: eventId=1084139354956127055 severity=warning

originator:

hostId: xxxxx.blah.com

appName: kernel

appInstanceId:

time: offset=-300 timeZone=EST 1141813394351496000

errorMessage: name=errSyslog e1000: eth0 NIC Link is Down

evError: eventId=1084146174954547201 severity=warning

originator:

hostId: xxxxx.blah.com

appName: kernel

appInstanceId:

time: offset=-300 timeZone=EST 1141816178210210000

errorMessage: name=errSyslog e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex

Just a thought, but perhaps it somehow got forced in 1000/full? Should I try setting it to auto/auto? If so, do I do that from the service account? And what commands would I issue?

Thanks all!

[r-simpson]

The error message is generated by the sensor the sensing process (SensorApp) should always be running. If it is not, you do not receive any alerts. If the interface is down, make sure the sensing port is connected properly:

a. Make sure the sensing port is connected properly on the appliance.

See the chapter on your appliance in the Cisco Intrusion Detection System Appliance and Module Installation and Configuration Guide Version 4.1.

b. Make sure the sensing port is connected to the correct SPAN or VACL capture port on the IDSM-2.