Guest

Preview Tool

Cisco Bug: CSCtf15367 - IDS: Global Correlation health metric shows unrealistically-high value

Last Modified

Feb 22, 2014

Products (10)

  • Cisco IPS 4200 Series Sensors
  • Cisco IPS Sensor Software Version 7.0
  • Cisco IPS 4255 Sensor
  • Cisco Catalyst 6500 Series Intrusion Detection System (IDSM-2) Services Module
  • Cisco IPS 4260 Sensor
  • Cisco Intrusion Prevention System Network Module
  • Cisco IPS 4270-20 Sensor
  • Cisco IPS 4240 Sensor
  • Cisco ASA Advanced Inspection and Prevention (AIP) Security Services Module
  • Cisco Integrated Services Routers Intrusion Prevention System Module

Known Affected Releases

7.0(1)E3 7.0(2)E3 7.0(2)E4 7.0(4)E4 7.1(1)S 7.1L 7.2(1)D

Description (partial)

Symptom:

The Global Correlation sensor health metric shows as an unrealistically-high value number 
(approximately 1,266,503,800 plus seconds of device uptime). Since this value is greater than both 
the Yellow and Red Threshold values, the Global Correlation health metric shows as Critical (Red).

This can/will be observed via IDM and IME (IPS Manager Express) and the Red condition itself via 
the sensor's 'show health' CLI command output. 


Conditions:

Sensor running IPS 7.0 software on which Global Correlation has never successfully performed an 
update. By-default, 7.0 sensors (new installs and upgrades from prior versions) will not successfully 
update Global Correlation, as a requirement for such is to configure one or more valid DNS servers 
and (if the network environment makes use of a proxy) a proxy server.

As such, all 7.0 sensors will encounter this behavior until Global Correlation has successfully updated 
at least once.
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.