Preview Tool

Cisco Bug: CSCsz50912 - 4215 memory exhaustion problems during sigUpdate or regex rebuilding

Last Modified

Feb 22, 2014

Products (1)

  • Cisco IPS 4200 Series Sensors

Known Affected Releases

6.0(5) 6.0(5)N

Description (partial)

SensorApp (AnalysisEngine) not running or not responsive.

This condition is heavily influenced by custom tunings and custom signatures.

Recent testing shows that if you had CLI running "show conf" (or editing signature config) at the same time a remote getDefaultConfig (sigDef) CT was occurring (IDM, IME, or CSM editing the signature config), you would be consuming an additional 50 to 60 Meg of sensor memory which could exhaust the sensor's memory.  In this scenario, from the top utility you would see cidcli running over 25Meg in size and mainApp(webserver) over 30Meg in size.  NOTE: the mainApp memory increase due to a remote getDefaultConfig CT was resolved in a separate DDTS.

It was also discovered that if CLI is run with the following commands:

    sensor# conf t
    sensor(config)# ser sig sig0

then that CLI process will run at over 24Meg in size and that memory will not be released until the CLI process is exited.
Bug details contain sensitive information and therefore require a account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.