signature sp update fails for s189

[darin.marais]

Whenever I try to apply the signature update file IDS-K9-sp-4.1-5-S189.zip to the 4.1.4s187 sensor, the vms server reports an error

Sensor sensorABC: Signature Update Process

An error occurred while running the update script on the sensor named sensorABC. Detail = An error occurred at the sensor during the update, sensor message = Connection failed

MC database sync complete.

How can I troubleshoot this problem?

Can I manually check the ssh connection from the sensor to the vms station?

Which log files can be used to give more information?

I have tried to renew the signature on the sensor by using the following method but this did not help.

trustingSensor# configure terminal

trustingSensor(config)# service trustedCertificates

trustingSensor(config-TrustedCertificates)# show settings

All the trusted hosts are listed.

I deleted the trusted host that is was causing the error:

trustingSensor(config-TrustedCertificates)# no trustedCertificates commonName xxxx trustingSensor(config-TrustedCertificates)# exit Apply Changes:?[yes]: yes

Now add the trusted host's certificate:

trustingSensor(config)# tls trusted-host ip-address xxxx Certificate MD5 fingerprint is xxx

Certificate SHA1 fingerprint is xxx

Would you like to add this to the trusted certificate table for this host?[yes]:

Certificate ID: xxxx succesfully added to the TLS trusted host table.

trustingSensor(config)# exit

[ibanezm]

What IDS MC version are you running? You need 2.x

[darin.marais]

i use 2.1 of the ips mc

[darin.marais]

I have a solution to my problem

I had to manually apply the service pack to each sensor in the network. (pain...ouch!!)

Example: upgrade URL-ftp://user @sensor/IDS-K9-sp-4.1-5-S189.rpm.pkg

I then queried each sensor in network from the vms server for its “new” identification and version information and after all of that I was able to use the vms server to apply “IDS-sig-4.1-5-S192.zip” signature update