Re: IPS Manager Express (IME) issue

rolltidega72 · ‎10-14-2009

After installing Cisco IME, if I log off the server it is installed on, the IPS Manager Express service stops. I know there is a reason this happens but I do not remember what and how it occurs. If anyone can tell me how to fix this I would appreciate it. Thanks...

andrey.dugin · ‎10-16-2009

Go to services.msc and check username who launchs MYSQL-IME and Cisco IPS Manager Express.

It must be Local System for proper functioning. I think that your IME processes are started by some user.

soc · ‎10-16-2009

message deleted

rolltidega72 · ‎10-16-2009

No it is Local System. What I am seeing in the event viewer when I log off is the service stop with a message saying that the service was terminated with the error Access is denied.

It is almost like Local System does not have the rights to keep the service running. I know that the service spawns off a Java program called IMEJava.exe so I am suspecting that maybe the Java process cannot run as local system? Just throwing that out there.

Alltimed · ‎10-23-2009

Can't believe no one else is having this issue or has a resolution. From what I can tell if you have IME 7.x running on an XP machine the service will terminate when you logoff. This will also apply if you logon to a Win2k3 console session. The service will continue to work if you connect via RDP to a non-console session though.

stleary · ‎10-24-2009

This is a known problem, tracked by:

CSCtc12978 IME Process stops when user logs off

Currently this is a minor bug, possibly due to the workaround posted in the DDTS Release Notes. I notice this bug has attracted a number of customer care cases recently. Contact your TAC rep if you think it needs to be fixed sooner rather than later.

Thanks,

Sean

Farrukh Haroon · ‎10-24-2009

Thanks for the info Sean.

Please let us know when this bug is fixed.

Regards

Farrukh

rolltidega72 · ‎10-26-2009

Yeah it was fixed with the last IME version before this one came out. Blows my mind that the newest version had the problem come back.

1sinishae1 · ‎09-06-2012

I'd like to revisit this as we're experiencing this with our IPS. The service is using the Local System Account. We've upgraded to the latest IPS version (7.2.3) and we're still seeing this service stop and MARS is continually reporting an 'inactive device'.

Any assistance would be greatly appreciated.

udupa · ‎09-10-2012

Hi,

From your post, it appears its not related to IME. IME and MARS are different products. Are you talking about IPS device being reported inactive device by MARS?. Can you elabarote the issue?

1sinishae1 · ‎09-10-2012

Thanks for your reply Ganesh. I'll try an explain what I've seen. I realize these are seperate products.

The service in our IPS is continually being stopped. I notice it when I log into the IPS and see the event status as 'Not connected'. If I verify this in the services, I can confirm it's stopped. Now, originally i wasn't sure if the following had anything to do with the IPS issue but when I'd look at my MARS logs I did/do see events in there stating 'CS-MARS - inactive reporting device' and it references both my IPSs.

I seperated these two as their own problems and troubleshooted them individually. In MARS, the password to communicate to the devices was incorrect and I've since entered the correct password and am nowable to discover my IPS. But I still see the 'CS-MARS - inactive reporting device' being reported in MARs.

So, back to the IPS, based on many of the forums I've read, I get the similar issues that others have reported. Everything thing seems fine until I log out of the IPS. When I try to log back in after 'x' amount of time, the event status will eventually report 'not connected' and if I check the service, it is stopped.

We thought maybe a version upgrade would assist so we upgraded to 7.2.3 but no luck.

Please let me know any additional information you require.

udupa · ‎09-11-2012

Hi, The original issue discussed in this thread was about IME Service shutting down when the user logs out from the IME machine. Its not about log out from the IPS device.

Anyways..I think you are talking about the column Event Status of the device in the IME home page. This will show Not Connected when IPS device is not reachable. During an IPS device reload also it will show as not connected. However, IME will automatically connect when the IPS reloads.

I request you to do the following.

1. Check if the windows service IPS Manager Express is started. ( Control Panel >

Cisco IPS Manager Express). If not, please start it

2. Make sure the credentials of IPS device in IME are valid. Go to the home page of IME gui client. Select the device. Right click and select edit device. Click on ok.

3. Check if event connection is stopped. Go to the home page of IME gui client. Select the device. Click on the toolbar, Start, click on event connection.

4. Check if there are any network communication related issues between IME machine and the IPS device.

Please let us know if you face any issues.

1sinishae1 · ‎09-11-2012

This is what I'm referring to as well. I'm just trying to provide some background to our environment and the alerts I see that may or may not be related. The bottom line issue is that my service is stopping on the IME machine. My apologies if I misused the terminology.

When I see the event status in the IPS manager express (gui) and it says 'not connected' this is when I know that my service has stopped so I restart it everytime. Is there a difference in needing to restart it in the device list or in the services list?

Regardless of which is correct I'm still wondering why the service continually stops??

udupa · ‎09-11-2012

Hi,

When you see the event status "Not connected" it doesnt necessariy mean IME Service is stopped. It could also be due to IPS device not being reachable.

We havent come across any case of IME service stopping repeatedly. ( Apart from CSCtc12978, where it it shuts down after windows user logout. But this was fixed).

Does windows event viewer or IME service log ( $IMEInstalldirectory/log/service-log.txt) indicate a service shutdown?. In the log file, please look for "IME service stopped"

1sinishae1 · ‎09-11-2012

The 'not connected' could very well mean something else but when I restart the service then the connection is reestablished. Again, it might be conincidence but those are my observances.

I'm not sure if something is lost in translation but I am experiencing what you are describing in the sense that if I log out and upon next login, things will stop. I'm not aware of the time in between taht it takes to stop the servcie as I don't visit the box that frequently but each time (at least every day or every 3rd day) it has stopped and I needed to restart the service.

The event viewer give me this error: 'The Cisco IPS Manager Express Serives terminated with the following error: Access is Denied"

Again, it's a local account, if I restart the service it starts no problem and guessing it would have the correct permissions assigned if it started the service.

If i look at the IME service log, it just states IME service stopped.