Solved: Upgrading Engine Version on IPS 4240

kiran.raj1 · ‎11-29-2010

Hi,

I am running an IPS 4240 Sensor with Engine Version 7.0(1) E3 and the Sensor always has a high load of 97-98%. Is it recommended to update the sensor to the latest engine version, considering the amount of load on it right now?

Thanks

Kiran

Justin Teixeira · ‎11-29-2010

Hi Kiran,

You'll need to update the engine either way since you cannot use the latest signature definitions without being on the latest engine. As long as you're not seeing dropped packets at the sensing interface level, it's fine for the CPU utilization to be that high. If you begin to see discarded packets you'll need to either reduce the amount of traffic being sent to the sensor or reduce (by disabling and retiring) the number of signatures inspecting traffic on the sensor.

Best Regards,

Justin

View solution in original post

Justin Teixeira · ‎11-29-2010

Hi Kiran,

You'll need to update the engine either way since you cannot use the latest signature definitions without being on the latest engine. As long as you're not seeing dropped packets at the sensing interface level, it's fine for the CPU utilization to be that high. If you begin to see discarded packets you'll need to either reduce the amount of traffic being sent to the sensor or reduce (by disabling and retiring) the number of signatures inspecting traffic on the sensor.

Best Regards,

Justin