Reports not executed in the VMS Security Monitor

[jodr]

This is our configuration :

- Cisco Works Common Services V2.2

- CWCS Foundation V2.2

- Management Center for Cisco Security Agents 4.0

- IDS MC V1.2

- Security Monitor 1.2

When we generate reports, they appear into the Reports/Scheduled view of VMS Security Monitor in a 'Waiting' state. And they remain in 'Waiting' until we reboot the management station. Then the reports are queued and executed.

Johan Derycke.

[dlac455]

The same has happened to me. In a sad way, I miss CSPM.

[james.e.mcwilliams]

I too have noticed this but instead of rebooting the management station. Go into Cisco Works and under "Server Configuration" and "Process Management". Then go to "Stop Processes" then chose IDS_ReportScheduler then goto "Start Process" and restart it after it has stopped. This usually does the trick for me. If not go to "Stop Process" and do a System stop and then restart it.

I haven't had the time to look into why the report is failing totally but if I do I will repost it here. I do know doing it this way keeps you from having to visit the server or do a reboot of the system.

[bbenton]

We have the same problem. I've been stopping and restarting crmdmgtd. But mine also prevents config change pushes to the sensors too. Sometimes it works for a few days, but mostly it's a daily event. Very annoying Cisco!!!

[mcvosi]

Johan, I've been working with TAC on this very issue. So far, we're been able to determine that certain processes are not shutting down gracefully, which causes problems when you reboot the server to install Windows patches, for example.

Here's something to try, and be sure to specify your DB password when issuing the command:

---

From the CiscoWorks desktop, go to Server Configuration/Administration/Process Management/Stop Process, select the System radio button, then click Finish.

Give it a few minutes to stop all its child processes, I think it will jump you to the Process Status panel.

Then issue the command:

dbisql -c "uid=idsmdc;pwd=PASSWORD;dbf=c:\progra~1\cscopx\mdc\sybase\db\ids\idsmdc.db;eng=sqlcoredbserver" truncate table kickRegistry

Then go to Server Configuration/Administration/Process Management/Start Process, select the System radio button, then click Finish. Give it a few minutes to start everything back up. Again, it should jump you to the Process Status panel when it is done.

---

Matt

[emusican]

Im having a similar problem.

When I generate a report it shows up in the schedued tab for a few minutes. I can see dbserv7 process running around 40% at this time. Eventually the dbserv7 comes down to 3% and the report in the scheduled tab disappears. So I clicked the view tab, and ...its empty. I tried to run the dbisql command and it ran, but the same symptoms persisted. Restarted daemons, same thing.

As a side note, I cant verify sensor deployment configs either. The Event Viewer isnt displaying the right levels that I tuned in the IDS MC.

I wish someone had some good fixes for these problems, they seem to be occuring everywhere.

Eric

[mcvosi]

Eric, have you tried to remove the sensor and add it back to the MC?

[jodr]

Matt,

Thanks for your suggestion. At the very moment we were experiencing these problems, we had also problems with the fact we used other regional settings than English US. However we used a workaround then by setting to English US and resetting after reboot to our local settings. At the end we left them in English US and we tried to work that way. That was also probably the reason why certain processes suddenly shut down, also the reporter and we had to restart this process manually. Now we installed the patch for the problem of the regional settings and everything is running more stable now. Nevertheless, I had it once more last week and just rebooted the system to trigger the requested reports. I'll keep you posted if this happens again.

Best regards,

Johan.

[jodr]

Matt,

To my reply of this morning, I have to add that after the reboot of Friday noon (I didn't notice until now) some processes were shut down :

- IDS_Analyzer

- IDS_Backup

- IDS_DbAdminAnalyzer

- IDS_DeployDaemon

After a manual restart, everything is stable again.

We'll keep you posted ...

Best regards,

Johan Derycke

[dblairii]

Johan -

I have been experiencing the exact problem with these four services (Plus the IDS_ReportScheduler). Sometimes the failure of these services seem to correlate with the scheduled generation of a report.

I have a TAC case open (for about two weeks), and don't yet have a solution; though they darn near have a copy of my server's hard drive. This apparently is not an isolated issue.

Thanks,

Don

[mjuckett]

I've experienced the same problem as well with a few of the services turning off randomly. I usually don't notice it until I try and push out a change and don't receive an e-mail confirmation. I don't run the reports so I can't say that mine fail in correspondence with anything. As yet I haven't opened a ticket as this has been the least of my problems. I wish y'all luck on this. Please let us know what is found by TAC.

Thanks.

[darin.marais]

Just to add fuel to the fire, We have also experienced the problem. Our system seamed to run correctly until around about the change over to day light savings, however I cannot be sure.

Could this have something to do with the problem?

Our Symptoms include “sensor configuration push” remains scheduled until the services are stopped and restarted at the server.