Solved: iplogs disappear?

mhellman · ‎03-09-2006

Is there any reason why the iplogs on a sensor would suddenly disappear? I thought it was a "circular buffer"? I had all of them wiped out on a couple sensors for some reason. They were there yesterday, not today. I did apply a couple sig tuning changes, but I did the same to other sensors and they still have their iplogs. Any ideas?

marcabal · ‎03-09-2006

Was the sensor rebooted?

On the newer sensors (like the IPS-4240 and IPS-4255) the compact flash is not large enough to hold 512MB of iplog data. So the IP Logs are stored only in RAM and will be lost on a reboot of the sensor.

SIDE NOTE: The eventstore on these sensors is also stored in RAM. But when a shutdown, or reset is done the sensor will automatically compress the live eventstore and write it to the compact flash. The sensor will then uncompress the file back into RAM after the reboot.

But if the sensor is power cycled with the power button, then the sensor does not have a chance to compress the eventstore on to to the compact flash and the events will be lost.

View solution in original post

marcabal · ‎03-09-2006

Was the sensor rebooted?

On the newer sensors (like the IPS-4240 and IPS-4255) the compact flash is not large enough to hold 512MB of iplog data. So the IP Logs are stored only in RAM and will be lost on a reboot of the sensor.

SIDE NOTE: The eventstore on these sensors is also stored in RAM. But when a shutdown, or reset is done the sensor will automatically compress the live eventstore and write it to the compact flash. The sensor will then uncompress the file back into RAM after the reboot.

But if the sensor is power cycled with the power button, then the sensor does not have a chance to compress the eventstore on to to the compact flash and the events will be lost.

mhellman · ‎03-09-2006

thanks for the information. I rebooted those sensors, so that explains it.