IPS - Segmentation Fault

[Martin Bosch]

Hi all,

I am running 2 IPS's, I updated them with a signature.

The one loaded fine, the other... Well in short gave me the following

ICCIPS login: <removed>

Password:

Last login: Mon Jul 11 11:38:25 on ttyS0

***NOTICE***

This product contains cryptographic features and is subject to United States

and local country laws governing import, export, transfer and use. Delivery

of Cisco cryptographic products does not imply third-party authority to import,

export, distribute or use encryption. Importers, exporters, distributors and

users are responsible for compliance with U.S. and local country laws. By using

this product you agree to comply with applicable laws and regulations. If you

are unable to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to

export@cisco.com.

Error: Cannot communicate with mainApp (getVersion). Please contact your system                                                                               administrator.

Would you like to run cidDump?[no]: yes

Transfer file to remote server or display to screen?[transfer]: display

/usr/cids/idsRoot/bin/cidDump: line 233: 20371 Broken pipe             cat $IDSROOT/etc/config/signatureDefinition/default.xml

     20372 Segmentation fault      | gzip -d - >$TMPDIR/cidDump.output

Is there a easy way of fixing this, or does this mean re-image?

[Martin Bosch]

Seems like it's sorted, I left the IPS for 2 hours, did a

"service-module idS-Sensor 2/0 reset" left another hour... tried it again "

service-module idS-Sensor 2/0 reset" , seems luck was on myside. its running as it should.

no re-image.

[Nicolas Fournier · Accepted solution]

Hi Martin,

The message "Error: Cannot communicate with mainApp (getVersion). Please contact your system administrator." that you had means that there has been a software crash on your IPS.

Resetting the module will clear it (and it did) but it might come back so I would advise you to upgrade to the latest version in the train you are currently running to pick up all the fixes which were integrated there and to open a TAC case if you are interested in the exact root cause of the issue.

Regards,

Nicolas

[Martin Bosch]

Hi Nicolas,

I am running version 7.0(5a)e4 with sig version 580. This does not seem to be a recurring problem, so I’ll leave it for now. - Thanks!!!

Regards,

Martin