IOS IPS Error Messges

[ms4561]

A few days ago I upgraded to IOS 12.4(11)T1.implementing IPS V5. I'm receiving the following error messages:

Feb 19 10:22:15.231 Brisban: %IPS-4-SDF_LOAD_FAILED: failed to open SDF from flash:/ips5/Mars-sigdef-delta.xml (File not found)

Feb 19 10:22:15.243 Brisban: %IPS-3-INVALID_TYPEDEFS: Typedef version 2006-08-02 already loaded

Feb 19 10:22:15.251 Brisban: %IPS-3-IPS_FILE_OPEN_ERROR: flash:/ips5/Mars-seap-typedef.xml - File or directory already in use

Feb 19 10:22:15.267 Brisban: %IPS-3-IPS_FILE_OPEN_ERROR: flash:/ips5/Mars-seap-delta.xml - File or directory already in use

Can anyone advise what the problem might be & how to correct problem.

Regards

[ymzhang]

Mike,

I checked your attached configuration and show command output. I did not see problems with the configuration.

The first message, Mars-sigdef-delta.xml not found seems cosmetic issue in your case, since the 'show flash' command does not list this file. This delta.xml file contains all your signature changes which are different from the default Cisco signature configuration. If you do not have any change, then you should not see this file on the flash. In your case, it seems the router is trying to find this file. (I think you were seeing this during a router reload?).

The INVALID_TYPEDEFS is a info message you can ingnore here. Since the typedef file already loaded in your case.

I need more context when you see those types of messages. Do you see these messages during reboot? or during some configuration task, such as load signature pkg file?

Thanks,

-Chris

[ms4561]

These messages only appear on bootup or reboot, no other time.

Regards

[ymzhang]

These are cosmetic issues since it only appear on bootup time and it does not affect the function/operation of the IOS IPS feature on your router.

To give you more detail, I think IPS is trying to search and apply the delta.xml but can not find the file in your case, so it prints out an error message.

I think it is a cosmetic level bug for ios ips that should be addressed.

Thanks,

-Chris

[ms4561]

Many thanks for comments.

Regards