Cisco IPS Subscriptions

Question

Hi,
We are attempting to move from the old Security Monitor in Cisco Works VMS to the realtime monitor (IPS Event Viewer) within CSM. The problem we are getting is a subscription error from the sensors when trying to open the realtime monitor.
Error Output: "Error: env:Sender-sd:errLimitExceeded-This subscription cannot be opened because the maximum number of subscriptions are already open
Please make sure the password and user name are correct."
I then login to the sensor CLI and issue the following command which indicates all the subscriptions are used:
# show statistics sdee-server
General
Open Subscriptions = 5
Blocked Subscriptions = 2
Maximum Available Subscriptions = 5
Maximum Events Per Retrieval = 500
Subscriptions
sub-103-f05ef2f9
State = Read Pending
Last Read Time = 02:18:47 UTC Sun Sep 27 2009
Last Read Time (nanoseconds) = 1254017927903746000
sub-160-512ad7bd
State = Open
Last Read Time = 18:34:02 UTC Sat Sep 26 2009
Last Read Time (nanoseconds) = 1253990042021593000
sub-161-a56e825f
State = Open
Last Read Time = 19:06:19 UTC Sat Sep 26 2009
Last Read Time (nanoseconds) = 1253991979244898000
sub-162-14e2fa66
State = Read Pending
Last Read Time = 02:18:43 UTC Sun Sep 27 2009
Last Read Time (nanoseconds) = 1254017923766659000
sub-25-61ecf3a3
State = Open
Last Read Time = 02:18:51 UTC Sun Sep 27 2009
Last Read Time (nanoseconds) = 1254017931007785000
Is there any way to manually clear the subscriptions without rebooting sensor?

Answer 1

There is not a command on the sensor itself for closing the older subscriptions.
However, this can be done through a standard web browser using the following URL:
https:///cgi-bin/sdee-server?action=close&subscriptionId=
So if you wanted to close the 2 subscriptions that have not been used since Sat Sep 26th you would use the following 2 URLs (replace the 1.1.1.1 IP address with the actual address of your sensor):
https://1.1.1.1/cgi-bin/sdee-server?action=close&subscriptionId=sub-160-512ad7bd
https://1.1.1.1/cgi-bin/sdee-server?action=close&subscriptionId=sub-161-a56e825f
If you know the actual username used to open the subscription, then I would recommend using that username and password when connecting to the sensor for the above URLs (your browser should prompt for a username and password).
If you do Not know which username was used to open the subscription, then I would recommend trying to use the standard "cisco" account when prompted for the username and password.