Guest

Preview Tool

Cisco Bug: CSCul00198 - IPS: sensorApp (AnalysisEngine) NotRunning after S749 Update

Last Modified

Feb 12, 2018

Products (1)

  • Cisco IPS 4200 Series Sensors

Known Affected Releases

0.0(0)S749

Description (partial)

Symptom:
sensorApp process (AnalysisEngine) on IPS is NotRunning. A /usr/cids/idsRoot/core/sensorApp/core.txt file may be present (visible via 'show tech' command output or cidDump) containing lines such as:

 /usr/cids/idsRoot/bin/sensorApp(_ZN3Cid6Sensor3Eng15TREThreadHandle7allocRHEPNS1_13MatcherHandleEPNS0_11CsidsBufferEPNS1_6DMABufEPhjjb+0x152)
 /usr/cids/idsRoot/bin/sensorApp(_ZN3Cid6Sensor3Eng15TREThreadHandle15searchAsyncXPktEPNS1_19StreamMatcherHandleEPNS0_11CsidsBufferEPNS1_6DMABufEPhjjb+0x71c)
 /usr/cids/idsRoot/bin/sensorApp(_ZN3Cid6Sensor3Eng20InspectorTCPStringXL10inspectTCPEPNS0_11CsidsBufferE+0x217)
 /usr/cids/idsRoot/bin/sensorApp(_ZN3Cid6Sensor4Proc23StreamDispatchProcessor7processERNS0_11CsidsBufferE+0x58c)
 /usr/cids/idsRoot/bin/sensorApp(_ZN3Cid6Sensor4Proc13DualProcessorINS1_23StreamDispatchProcessorENS0_13VirtualSensorENS1_17ThreadedProcessorIS3_S4_EEE11dispatchBufERNS0_11CsidsBufferE+0x397)
 /usr/cids/idsRoot/bin/sensorApp(_ZN3Cid6Sensor4Proc19NormalizerProcessor7processERNS0_11CsidsBufferE+0x1c3)
 /usr/cids/idsRoot/bin/sensorApp(_ZN3Cid2Mt9AsyncLock10submitWorkEPFvRS1_NS1_14CallbackStatusEPvS4_EPFvPNS1_12QueueElementES4_S4_ES4_S4_S8_bjb+0x1f9)
 /usr/cids/idsRoot/bin/sensorApp(_ZN3Cid6Sensor13VirtualSensor7processERNS0_11CsidsBufferEj+0x3df)
 /usr/cids/idsRoot/bin/sensorApp(_ZN3Cid6Sensor9SensorApp20userModeProducerLoopEj+0x98f)
 /usr/cids/idsRoot/bin/sensorApp(_ZN3Cid6Sensor9SensorApp21startUserModeProducerEPNS_2Mt12ThreadedTaskEPv+0x5f)
 /usr/cids/idsRoot/lib/libcidcore.004.002.so(_ZN3Cid2Mt12ThreadedTask11threadStartEPv+0xc3)


Additionally, the following messages may be present (repeatedly) in the /usr/cids/idsRoot/log/main.log file:

 sensorApp[<PID>] sensorApp/E DMABuf (rgxMalloc) failed!
 sensorApp[<PID>] sensorApp/E allocResultsBuffer (rgxMalloc) failed!
 sensorApp[<PID>] sensorApp/E Queue out of sequence.

Additionally, the following message may be present (repeatedly) in the /var/log/messages file:

 libcppuser[<PID>]: WARNING cpp_user_lib_linux.c:cppuBaseMalloc:445: Failed to allocate 8192 bytes in KVM shared memory

Conditions:
IPS sensor device model that includes one (1) or more Regex hardware acceleration card(s) running affected software version on which Signature Update S749 has been installed. Affected device models include:

 -ASA5525-X (if the IPS software module has been enabled/configured)
 -ASA5545-X (if the IPS software module has been enabled/configured)
 -ASA5555-X (if the IPS software module has been enabled/configured)
 -ASA5585-IPS-SSP-10
 -ASA5585-IPS-SSP-20
 -ASA5585-IPS-SSP-40
 -ASA5585-IPS-SSP-60
 -IPS-4345
 -IPS-4360
 -IPS-4510
 -IPS-4520

Related Community Discussions

Analysis engine goes down after few days of uptime
Hi Expert, We are facing the same issue with multiple IPS software modules across our network. The Analysis Engine goes down after few days which in turn triggers the failover(which is expected). I found few bugs CSCul05345  https://bst.cloudapps.cisco.com/bugsearch/bug/CSCul05345/?referring_site=bugquickviewredir <key>CSCul00198</key> https://bst.cloudapps.cisco.com/bugsearch/bug/<key>CSCul00198</key>/?referring_site=bugquickviewredir The Second one looks almost similar to the logs I am seeing in main.log file but the ...
Latest activity: Mar 10, 2019
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.