Cisco Bug: CSCsz50912 - 4215 memory exhaustion problems during sigUpdate or regex rebuilding
Feb 22, 2014
- Cisco IPS 4200 Series Sensors
Known Affected Releases
Symptom: SensorApp (AnalysisEngine) not running or not responsive. Condition: This condition is heavily influenced by custom tunings and custom signatures. Recent testing shows that if you had CLI running "show conf" (or editing signature config) at the same time a remote getDefaultConfig (sigDef) CT was occurring (IDM, IME, or CSM editing the signature config), you would be consuming an additional 50 to 60 Meg of sensor memory which could exhaust the sensor's memory. In this scenario, from the top utility you would see cidcli running over 25Meg in size and mainApp(webserver) over 30Meg in size. NOTE: the mainApp memory increase due to a remote getDefaultConfig CT was resolved in a separate DDTS. It was also discovered that if CLI is run with the following commands: sensor# conf t sensor(config)# ser sig sig0 then that CLI process will run at over 24Meg in size and that memory will not be released until the CLI process is exited.
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.
Bug Details Include
- Full Description (including symptoms, conditions and workarounds)
- Known Fixed Releases
- Related Community Discussions
- Number of Related Support Cases