Is anyone else aware the IDS 3.0 release can corrupt sensors?

[john.maxwell]

IDS 3.0 will corrupt your sensor because of a conflict between it and the SHUTDOWN command.

It is apparently a known problem, but I don't recall receiving any notification of it. There is good documentation on handling it and doing a wor around, but you need to know this BEFORE you try to SHUTDOWN a sensor.

[jekrauss]

John,

Here is the field notice that describes the issue, including workarounds:

Cisco Secure Intrusion Detection System Sensor Hard Disk Corruption

http://www-tac.cisco.com/Support_Library/field_alerts/fn15269.html

You can subscribe to field notices to ensure that you are notified about relevant issues as soon as we become aware of them, by subscribing to the field notice tool.

http://www.cisco.com/cgi-bin/Support/FieldNoticeTool/field-notice

Also, you'll notice that this has a bug assigned. You can follow the status of this bug (and any others), and receive emails when a change is made, by utilizing the Bug Toolkit:

http://www.cisco.com/kobayashi/support/tac/t_index.shtml

Hope this helps.

Jeff

[dlac455]

The problem I had was a power outage. My sensors got corrupted and needed the fsck run. Yeah I know they should be on a UPS. But what I didn't know was that the tty port was not the console. The console is the VGA video port. You don't get the error msgs on the tty port, only the VGA port. So I ended up reloading one of my sensors from scratch before I realized this.

[john.maxwell]

Hmmm - I get a 404 page on the field notice address even when logged in.

I am already signed up for NetRanger. I don't recall getting a field notice about this.

Thanks.

[jekrauss]

John,

Sorry, that was internal. Here's the publicly available one which you should have gotten if you are subscribed to the Field Notice Tool:

http://www.cisco.com/warp/public/770/fn12044.shtml

Jeff