issue with security intelligence

[Teofanis]

In fmc version 10 i see this critical alert 

Security Intelligence

2 System feeds failed

response processing failed for Cisco_DNS_Intelligence_Feed

response processing failed for Sourcefire_Intelligence_Feed

i logged in the fmc cli and i can connect to updates-talos.sco.cisco.com 443 and est.sco.cisco.com 443

did anyone encounter this till now ? 

[Mark Elsen]

  - @Teofanis               Check /var/log/messages and look for more info's , if any, concerning these messages

  M.

[Teofanis]

hello @Mark Elsen ,

Unfortunately no useful info found in messages.

[Mark Elsen]

 - @Teofanis  Then report to TAC

 M.

[Uwe Siegrist]

Yes, one of my customers is having exactly the same problem. FMC is 10.0.2.

Additionally there is also the message "Talos Communication Daemon not updating health" for FMC and two FTDs.

[DFWTechGuy]

Since both Cisco_DNS_Intelligence_Feed and Sourcefire_Intelligence_Feed are failing, I’d check the FMC logs for the exact feed-processing error rather than focusing only on TCP connectivity.

You can start by checking /var/log/messages around the time the alert occurred. If there’s no useful information there, collect the relevant feed-update logs and open a Cisco TAC case, especially since this is a critical alert. Another community reply on this same issue also recommends checking the logs and contacting TAC if they don’t reveal the cause. <Link url="https://community.cisco.com/t5/network-security/issue-with-security-intelligence/m-p/5573685" title="Cisco Community discussion"/>.

What exact FMC 10.x build are you running, and did this start after an upgrade or happen unexpectedly? That information may help identify whether it’s a version-specific issue.

[Teofanis · Accepted solution]

FMC version Version 10.0.0 (build 141) 

Deployed 2 of them. 

Both of them had the same alert and no useful info found in  /var/log/messages 

in the first FMC i opened a cisco tac and problem resolved from them with a restart in the relevant agents.

in the second FMC with the same version i proceeded with an update to Version 10.0.2 (build 79), this restarted the VM and issue resolved (but accidentally resolved this due to the restart of the FMC during the upgrade).