issue with security intelligence

[Teofanis]

In fmc version 10 i see this critical alert 

Security Intelligence

2 System feeds failed

response processing failed for Cisco_DNS_Intelligence_Feed

response processing failed for Sourcefire_Intelligence_Feed

i logged in the fmc cli and i can connect to updates-talos.sco.cisco.com 443 and est.sco.cisco.com 443

did anyone encounter this till now ? 

[Mark Elsen]

  - @Teofanis               Check /var/log/messages and look for more info's , if any, concerning these messages

  M.

[Teofanis]

hello @Mark Elsen ,

Unfortunately no useful info found in messages.

[Mark Elsen]

 - @Teofanis  Then report to TAC

 M.

[Uwe Siegrist]

Yes, one of my customers is having exactly the same problem. FMC is 10.0.2.

Additionally there is also the message "Talos Communication Daemon not updating health" for FMC and two FTDs.

[DFWTechGuy]

Since both Cisco_DNS_Intelligence_Feed and Sourcefire_Intelligence_Feed are failing, I’d check the FMC logs for the exact feed-processing error rather than focusing only on TCP connectivity.

You can start by checking /var/log/messages around the time the alert occurred. If there’s no useful information there, collect the relevant feed-update logs and open a Cisco TAC case, especially since this is a critical alert. Another community reply on this same issue also recommends checking the logs and contacting TAC if they don’t reveal the cause. <Link url="https://community.cisco.com/t5/network-security/issue-with-security-intelligence/m-p/5573685" title="Cisco Community discussion"/>.

What exact FMC 10.x build are you running, and did this start after an upgrade or happen unexpectedly? That information may help identify whether it’s a version-specific issue.