Global correlation update

Hi,
Will the IPS go offline during a global correlation update? We are running sensor version 7.1.(7)E4 and are noticing drops due to the IPS being unavailable. The timing of theses matches global correlation updates on the IPS.

We are receiving the following log entry when global correlation updates.
%ASA-3-420001: IPS card not up and fail-close mode used, dropping TCP packet from InterfaceA:x.x.x.x/xx to InterfaceB:y.y.y.y/yy

Similar Messages

Global Correlation update Failure error

Hello,
I have received following error in IPS regarding global correlation update
A global correlation update failed: ExecLoadCollabUpdate control transaction failed: Control transaction cannot be completed at this time
is any one aware about this error? is it major issue and affecting IPS? I think this is because correlation update failure. Please let me know if any one has more information on this error

Whenever a global correlation update fails, an evError event is generated. The error message is included in sensor statistics. The following conditions result in a status message with the severity of Error:
•The sensor is unlicensed
•No DNS or HTTP proxy server is configured
•The manifest exchange failed
•An update file download failed
•Applying or committing the update failed
For global correlation update fails, refer
http://www.cisco.com/c/en/us/support/docs/security/ips-4200-series-sensors/50360-ids-faq.html

Global Correlation Update Failures

I've recently turned on Global Correlation but we've failed to update every 5 minutes.
PL-ASA-IPS# show stat global
Network Participation:
   Counters:
      Total Connection Attempts = 2
      Total Connection Failures = 0
      Connection Failures Since Last Success = 0
   Connection History:
      Connection Attempt on February 16 2010, at 14:28:38 UTC = Successful
      Connection Attempt on February 16 2010, at 14:19:06 UTC = Successful
Updates:
   Status Of Last Update Attempt = Failed
   Time Since Last Successful Update = never
   Counters:
      Update Failures Since Last Success = 4
      Total Update Attempts = 4
      Total Update Failures = 4
   Update Interval In Seconds = 300
   Update Server = update-manifests.ironport.com
   Update Server Address = 204.15.82.17
   Current Versions:
      config = 0
      drop = 0
      ip = 0
      rule = 0
Warnings:
I have a static NAT translation for the IPS, there are no proxy servers in our enviorment and it can ping outside as well as update-manifests.ironport.com (204.15.82.17). DNS is setup as well.
In the logs I see this entry:
16Feb2010 14:13:15.679 265.199 collaborationApp[491] rep/E A global correlation update failed: Failed download of ibrs/1.1/config/default/1236210407 : HTTP connection failed
I guess I'm at a loss for what else I can check. We have no problems sending the Network Participation data but we can't get any data. Any suggestions?
Cisco Intrusion Prevention System, Version 7.0(2)E3
Signature Definition:
    Signature Update    S469.0                   2010-02-11
    Virus Update        V1.4                     2007-03-02
OS Version:             2.4.30-IDS-smp-bigphys

I have the same issue, i have no ASA or websense product between this device and the iNet.
Does anyone have a fix or workaround?
I have an AIM-IPS running 7.0(6)E4 with Signature versuon S599.0. All updates to date have been manualy d/l to a local ftp server
the auto update "seems" to run but never gets any updates
This is what i see
# sh stat global
Network Participation:
   Counters:
      Total Connection Attempts = 127
      Total Connection Failures = 127
      Connection Failures Since Last Success = 127
   Connection History:
      Connection Attempt on October 06 2011, at 10:46:32 UTC = Failed
      Connection Attempt on October 06 2011, at 09:24:32 UTC = Failed
      Connection Attempt on October 06 2011, at 08:03:04 UTC = Failed
      Connection Attempt on October 06 2011, at 07:59:52 UTC = Failed
      Connection Attempt on October 06 2011, at 06:36:57 UTC = Failed
Updates:
   Status Of Last Update Attempt = Failed
   Time Since Last Successful Update = never
   Counters:
      Update Failures Since Last Success = 2702
      Total Update Attempts = 2702
      Total Update Failures = 2702
   Update Interval In Seconds = 300
   Update Server = update-manifests.ironport.com
   Update Server Address = Unknown
   Current Versions:
      config = 0
      drop = 0
      ip = 0
      rule = 0
Warnings:
#sh ver
Application Partition:
Cisco Intrusion Prevention System, Version 7.0(6)E4
Host:
    Realm Keys          key1.0
Signature Definition:
    Signature Update    S599.0                 2011-09-29
OS Version:             2.6.14-Cavium-Octeon
Platform:               AIM-IPS-K9
Serial Number:          xxx
Licensed, expires:      31-Mar-2012 UTC
Sensor up-time is 9 days.
Using 54726656 out of 454148096 bytes of available memory (12% usage)
system is using 22.4M out of 80.0M bytes of available disk space (28% usage)
application-data is using 46.8M out of 213.0M bytes of available disk space (23% usage)
boot is using 54.4M out of 114.8M bytes of available disk space (50% usage)
application-log is using 61.8M out of 513.0M bytes of available disk space (12% usage)
MainApp            B-BEAU_2011_SEP_10_00_30_7_0_5_45   (Ipsbuild)   2011-09-10T00:32:09-0500   Running
AnalysisEngine     B-BEAU_2011_SEP_10_00_30_7_0_5_45   (Ipsbuild)   2011-09-10T00:32:09-0500   Running
CollaborationApp   B-BEAU_2011_SEP_10_00_30_7_0_5_45   (Ipsbuild)   2011-09-10T00:32:09-0500   Running
CLI                B-BEAU_2011_SEP_10_00_30_7_0_5_45   (Ipsbuild)   2011-09-10T00:32:09-0500
Upgrade History:
* IPS-AIM-K9-7.0-6-E4       17:39:07 UTC Sat Sep 10 2011
IPS-sig-S599-req-E4.pkg   07:59:08 UTC Wed Oct 05 2011
Recovery Partition Version 1.1 - 7.0(6)E4
Host Certificate Valid from: 25-Sep-2011 to 25-Sep-2013
>
as seen above there is no ip address listed for "update-manifests.ironport.com"
NS lookup is able to resolve,
why can't the IPS?
I can i hard code the ip address?
>Non-authoritative answer:
>Name:    update-manifests.ironport.com
>Address: 204.15.82.17

SSM-AIP 7.0(1) Global Correlation config nightmare!

Thanks, Cisco, for creating a Management nightmare with your "Global Correlation" option in version 7.0...
Lets start with the SSM-AIP-20 Management interface...
We have an OOB Management network, with a single POI into this through a separate PIX515E appliance. Both the ASA5540 AND the SSM-AIP-20 reside on this network.
The first issue was in Routing, since the ASA sees the Management network as "directly attached", and we ROUTE the traffic through the PIX for updates on the SSM module, we had to add translation entries in the PIX515E for the SSM module (10.x.x.x Management, 172.x.x.x translated).
This was not a big issue, but here is where the nightmare begins...
First a note: We have the Management network locked down TIGHT, only a couple of Network Management stations allowed into that network to access these devices.
I enabled Global Correlation in test mode, but it was "failed" every time it tried to update.. Reading other posts, I created ACL and Static NAT in the PIX515E for these IP's:
204.15.82.17 (IP listed in the IME Global Correlation update server)
97.65.135.170 and .137 (from another post in these forums)
207.15.82.17 (IP found in a trace)
Still no updates. Looking in the PIX logs, I found "no translation" entries for the following addresses:
198.133.219.25
209.107.213.40
208.90.57.73
I put these in, and it started updating! FIXED? NOT!
This morning, it was again failing... Looked in the PIX logs again, and found these:
77.67.85.33
77.67.85.9
Entered them, and the SSM is happy again. How long? Who knows?
So, now I have NINE holes in my "secure" network, and who knows when Cisco will change or add new IP addresses to this list.
Cisco, if you are listening - ALL access to/from the Global correlation through a single IP? PLEASE?
(use the one listed in the IME - 204.15.82.17, for the URL "update-manifests.ironport.com")

A few of the addresses belong to Cisco (originally ironport.com addresses from the ironport aquisition) and are used as manifest servers to provide the sensor a list of files to download.
The sensor then downloads those files from Akamai servers. Akamai has a large number of servers across the world. Cisco sends the update to Akamai and they replicate it across their servers. When sensors try to connect to the Akamai server it does a DNS query and by controlling the DNS response it can direct sensors to an Akamai server located nearer to the sensor. This allows for better load balancing, response times, and download speeds.
However, Akamai has a large number of servers (in the thousands I think) world wide, and you can't predict which server your specific sensor will be directed to.
Sensor connections to the cisco servers for the manifest (file list) is on port 443, and usually to update-manifests.ironport.com URLs.
Sensor connections to the Akamai servers for the actual file downloads are on port 80 and usually to updates.ironport.com URLs.
The above is all based on my limited understanding of how the updates work. I may have gotten a few details wrong, but should at least give you a general idea.
I will be working with development to get this better documented in Release Notes and Readme with the next IPS software release.

IPS 7.X Global Correlation in IME question

I was reading in the documentation for the new verison of IME that utilizes the new Global Correlation feature in IPS 7.X.
Quick question: Is the Global Correlation module a separate feature that has to be purchased? If so, do you license it for the IME or do you license it per sensor device? Would anyone be willing to share the cost?

The Global Correlation feature is licensed on the sensor rather than IME, but is not a new license, it is the same license used for signature updates. So the Cisco Service for IPS contracts provide the license that works for both Signature Updates and Global Correlation Updates.

IPS V7 Global Correlation

Dear all,
IPS Correlation update will be done through the Management interface right? So I should confirm the ability of the IPS Management IP address to be able to access internet right?
I did so, but still not able to have global correlation update, what I am having each time I enable global correlation is a boost of traffic generated from the IPS and directed to the outside that is consuming the total internet link bandwidth.
What could be the reason behind this boost, and how may I troubleshoot the reason why the correlation is not being updated.
Regards,

Hi,
I had the exact same problem that I solved to day.
Full connectivity but still the error:
# sh statistics global-correlation
Network Participation:
   Counters:
      Total Connection Attempts = 0
      Total Connection Failures = 0
      Connection Failures Since Last Success = 0
   Connection History:
Updates:
   Status Of Last Update Attempt = Failed
   Time Since Last Successful Update = 3826 minutes
   Counters:
      Update Failures Since Last Success = 764
      Total Update Attempts = 22747
      Total Update Failures = 806
   Update Interval In Seconds = 300
   Update Server = update-manifests.ironport.com
   Update Server Address = 204.15.82.17
   Current Versions:
      config = 1236210407
      drop = 1312830724
      ip = 1312830846
      rule = 1312744926
# sh events error error warning past 12:00
evError: eventId=1304592381890230981 severity=error vendor=Cisco
originator:
    hostId: xxxxxxxx
    appName: collaborationApp
    appInstanceId: 458
time: 2011/08/11 00:38:28 2011/08/11 02:38:28 GMT+01:00
errorMessage: name=errUnclassified A global correlation update failed: Failed download of ibrs/1.1/drop/default/1313021562 :
URI does not contain a valid ip address
Messages, like this one, in the category - Reputation update failure - were logged 49 times in the last 14699 seconds.
I found a tip when searching that worked for me :
Issue the: dns-secondary-server disable to flush DNS wait for GC to update again.
Thanks to: http://doublef.org/archives/cisco-ips-global-correlation-update-failures
HTH
Edit: I see a difference in our output, you don't have the ip address in update server field:
Update Server Address = Unknown
Might not bee the same problem.

Global-correlation does not update.

Hi all,
I have a problem to update the global-correlation. I do get updates for the signatures in the IPS but see output below regarding the global-correlation;
==========================================
show statistics global-correlation
Network Participation:
   Counters:
      Total Connection Attempts = 0
      Total Connection Failures = 0
      Connection Failures Since Last Success = 0
   Connection History:
Updates:
   Status Of Last Update Attempt = Failed
   Time Since Last Successful Update = never
   Counters:
      Update Failures Since Last Success = 8
      Total Update Attempts = 8
      Total Update Failures = 8
   Update Interval In Seconds = 300
   Update Server = update-manifests.ironport.com
   Update Server Address = 204.15.82.17
   Current Versions:
      config = 0
      drop = 0
      ip = 0
      rule = 0
Warnings:
===========================================
Hardware used:
asa-ssm-10 (version 7.0(4)E4)
ASA-5520(version 8.4(1))
I see all traffic passing the firewall and ISP-routers.
I hope someone can help me with this issue or some pointers.
Thanks in advance,
Erik Verkerk.

Hi Jennifer,
Good to hear we do not have to buy an additional license and that global-correlation is included in version 7.0.
Thanks for your suggestion "access to internet", I did a re-re-recheck of my configuration and found out that I had a "little routing issue in one of my routers". I solved this and now it is working.
===========================================
sh statistics global-correlation
Network Participation:
   Counters:
      Total Connection Attempts = 0
      Total Connection Failures = 0
      Connection Failures Since Last Success = 0
   Connection History:
Updates:
   Status Of Last Update Attempt = Ok
   Time Since Last Successful Update = 2 minutes
   Counters:
      Update Failures Since Last Success = 0
      Total Update Attempts = 269
      Total Update Failures = 268
   Update Interval In Seconds = 300
   Update Server = update-manifests.ironport.com
   Update Server Address = 204.15.82.17
   Current Versions:
      config = 1236210407
      drop = 1300274962
      ip = 1300276386
      rule = 1300221126
Warnings:
=================================
Thanks for your time and help.
Thanks,
Erik Verkerk.

Global correlation can't updated

version is IPS7.0, asa5520-aip-ssm.
Singatrue and IME can be sucessfully updated,
Global correlation can't updated,
the Status of global correlation is Critical.
I saw the website
http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/ime/ime_collaboration.html#wp1053280
and updated following the web page. But can't work it.
How could I update global correlation
or go back old sensorbase?

The output provided clearly indicates that the AIP-SSM is unable to resolve the update server address. The server name update-manifests.ironport.com is not user configurable.
Do you have more than one DNS server configured? If so, disable all but the primary DNS server.
If you only have one DNS server configured, please verify the AIP-SSM's management IP address has unrestricted access to the Internet. (At a minimum TCP ports 80 and 443 and UDP port 53).
Scott

Cisco IPS (global correlation) is downloading lots of updates from the iron-port website

I have query on Global correlation.
Following is the observed behavior
Scenario 1:
Global Correlation Inspection: ON (Standard)
Reputation Filter: ON
Result: Global correlation downloads in bytes or KBs (observed on proxy)
Scenario 2:
Global Correlation Inspection: OFF
Reputation Filter: ON
Result: Global correlation downloads 4-5 MB every 5 Minutes (observed on proxy)
This behavior has been observed on both IPS devices one by one. What we wanted the clarity on is why is does global correlation download so much of data when it is OFF, and downloads only minimal data when ON. The equation does not seem to be right.
Request you for your prompt response.
Regards,
Neal

Both global correlation and reputation filtering retrieve updates from the SensorBase network, or IronPort. By default, they communicate with the network every five minutes. This value cannot be changed by the IPS administrator.

Global Correlation Status

Hello Everyone,
i'm trying to enable global correlation, but, after apply the configuration, i see the status bellow:
service global-correlation
network-participation off
global-correlation-inspection-influence aggressive
test-global-correlation off
exit
service aaa
exit
service analysis-engine
virtual-sensor vs0
physical-interface GigabitEthernet0/1
exit
exit
IPS-SITE-BACKUP#
IPS-SITE-BACKUP#
IPS-SITE-BACKUP#
IPS-SITE-BACKUP# show health
Overall Health Status                                   Green
Health Status for Failed Applications                   Green
Health Status for Signature Updates                     Green
Health Status for License Key Expiration                Green
Health Status for Running in Bypass Mode                Green
Health Status for Interfaces Being Down                 Green
Health Status for the Inspection Load                   Green
Health Status for the Time Since Last Event Retrieval   Green
Health Status for the Number of Missed Packets          Green
Health Status for the Memory Usage                      Green
Health Status for Global Correlation                    Not Enabled
Health Status for Network Participation                 Green
Why the status is "not enabled"?
Obs: Downloads ok via proxy server.
Thanks.
Rafael

Hello Rafael,
Why the status is "not enabled
The status is not enabled because the participation of your IPS in the global correlation is off.
There are 3 states related to Global Correlation:
-Full
-Partial
-Off
Please change that and it should working, You need to have a DNS server set up in your IPS, if not Global Correlation will not work.
Julio
Rate the helpful posts

Global correlation events

I have an ASA 5510 with an SSM-10 module. I have global correlation turned on and updating. When I look at the dashboard's "Global Correlation Report" I see packets that have been denied by global correlation. Can someone tell me how global correlation events are logged? I'd like to be able to see the raw data associated with the global correlation.
Thanks.

Hi,
Take a look at this:
http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_collaboration.html#wp1065809
As can be seen, whenever "global correlation" causes any kind of action to be taken by the IPS it produces an alert unless the packet is being denied by "reputation filtering" which does not produce any kind of alert. Also, "This feature only applies to global correlation inspection where the traffic is allowed if no specific signature is matched".
I am not sure of all those fields in then alert but i have seen at least some of them. If you are not seeing any alerts with those fields, then global correlation may not be seeing any instances where it has had to modify the risk ratings and take appropriate actions for it, that is, you may not be receiving any kind of such packets from malicious hosts at all in the first place.
Also, if you have "reputation filtering" on, you might want to turn it OFF to ensure it is not causing this behavior.
Rregards,
Prapanch

Cisco ASA SSM-10 Global Correlation critical

Hello,
I have a high value for Global Correlation parameter, which I generated my ips module is alarmed, how I can reset this value?
Additionally, the automatical updates does not work properly in the module. What could be the problem?
Thanks for you help.

Ensure dns is configured on the sensor. It will need to communicate to receive updates. also ensure you have a valid license.
Sent from Cisco Technical Support iPhone App

Global Correlation and Application Failed

Hi, People.
I have IPS4270-20-K9 with version 7.0(3)E4 and signature version 572.
In Sensor Health show me a problem critical, with:
- Application Failed
- Global Correlation
sensor#sh statistics global-correlation
Error: getGlobalCorrelationStatistics : ct-collaborationApp.459 not responding, please check system processes - The connect to the specified Io::ClientPipe failed.
How do I resolve these problems?
Tks.

That error message indicates that one of the software processes required for the Global Correlation feature (CollaborationApp) is not responding (stopped/crashed, hung, etc.). You will need to reboot ("reset") the sensor to restore the process to a "Running" status.
There are multiple defects present in the version of software you are running (7.0(3)E4) that are likely culprits/causes that were fixed in subsequent releases (7.0(4)E4 and 7.0(5a)E4). After you have rebooted the sensor and restored it to service, you can upgrade to a fixed release (7.0(5a)E4).

Not all non-global zones updated for DST

We have one server with Solaris 10 and four non-global zones. I installed patch 122032-03 to the global zone and it installed successfull, according to the log. With the DST change on 3/11, TWO of the non-global zones and the global zone updated correctly to daylight time, but the other TWO non-global zone DID NOT. Does anyone know what would cause this?
I have also tried to manually change the time on the two non-global zones and have not been able to; as root I get the message "not owner"
ainsworth:hughesm> su -
Password:
Sun Microsystems Inc. SunOS 5.10 Generic January 2005
You have mail.
# date
Tue Mar 13 12:02:45 PST 2007
# date -u
Tue Mar 13 20:03:16 GMT 2007
# date
Tue Mar 13 12:04:31 PST 2007
# date 0313130007
date: Not owner
usage: date [-u] mmddHHMM[[cc]yy][.SS]
date [-u] [+format]
date -a [-]sss[.fff]
Fortunately, these were just test zones. They were set up by a previous admin to be used for pgpftp, so I'm wondering if there are some special configurations for security that is preventing the time change.

Thanks for replying.
I rebooted from the global zone. All the zones have the same uptime as the global zone, except one that was rebooted more recently.
Quick question - how do I tell if it's a sparse zone or full zone?
One of the zones that the time change worked on:
$ zdump -v US/Pacific | grep 2007
US/Pacific Tue Mar 13 22:37:59 2007 UTC = Tue Mar 13 15:37:59 2007 PDT isdst=1
US/Pacific Sun Mar 11 09:59:59 2007 UTC = Sun Mar 11 01:59:59 2007 PST isdst=0
US/Pacific Sun Mar 11 10:00:00 2007 UTC = Sun Mar 11 03:00:00 2007 PDT isdst=1
US/Pacific Sun Nov 4 08:59:59 2007 UTC = Sun Nov 4 01:59:59 2007 PDT isdst=1
US/Pacific Sun Nov 4 09:00:00 2007 UTC = Sun Nov 4 01:00:00 2007 PST isdst=0
tsbackup:hughesm> cd /usr/share/lib/zoneinfo; ls -al | grep Pac
drwxr-xr-x 2 root bin 1024 Jan 19 11:19 Pacific
cathedral:hughesm> cd /usr/share/lib/zoneinfo; ls -al | grep Pac (the global zone)
drwxr-xr-x 2 root bin 1024 Jan 19 11:19 Pacific
One zone that didn't work: (the other one that did not work is the same)
# zdump -v US/Pacific | grep 2007
US/Pacific Tue Mar 13 22:45:33 2007 UTC = Tue Mar 13 14:45:33 2007 PST isdst=0
US/Pacific Sun Apr 1 09:59:59 2007 UTC = Sun Apr 1 01:59:59 2007 PST isdst=0
US/Pacific Sun Apr 1 10:00:00 2007 UTC = Sun Apr 1 03:00:00 2007 PDT isdst=1
US/Pacific Sun Oct 28 08:59:59 2007 UTC = Sun Oct 28 01:59:59 2007 PDT isdst=1
US/Pacific Sun Oct 28 09:00:00 2007 UTC = Sun Oct 28 01:00:00 2007 PST isdst=0
# uname -a
SunOS albina 5.10 Generic_118822-02 sun4u sparc SUNW,Ultra-4
# cd /usr/share/lib/zoneinfo (non-global zone that did not update)
# ls -al | grep Pac
drwxr-xr-x 2 root bin 1024 Apr 20 2005 Pacific
I was thinking of trying to apply the patch within the zone itself, but when I tried smpatch analyze, it didn't list it:
# smpatch analyze
120900-04 SunOS 5.10: libzonecfg Patch
121133-02 SunOS 5.10: zones library and zones utility patch
119254-27 SunOS 5.10: Install and Patch Utilities Patch
119574-02 SunOS 5.10: su patch
121453-02 SunOS 5.10: Sun Update Connection Client Foundation
121118-08 SunOS 5.10: Sun Update Connection System Client 1.0.8
121081-05 SunOS 5.10: Connected Customer Agents 1.1.0
122231-01 SunOS 5.10 Sun Connection agents, transport certificate update
I attempted to add the patch using smpatch, but I've never run it here before so it's probably not configured right:
# smpatch update -i 122032-03
122032-03 cannot be validated.
com.sun.patchpro.model.PatchProRuntimeException: Unexpected throwable
at com.sun.patchpro.cli.PatchServices.waitForThread(PatchServices.java:1284)
at com.sun.patchpro.cli.PatchServices.installPatches(PatchServices.java:1121)
at com.sun.patchpro.cli.PatchServices.main(PatchServices.java:510)
Caused by:
java.lang.Throwable: ERROR: Failed to validate the digital signature(s).
at com.sun.patchpro.model.PatchProModel$InnerDownloadPatchThread.downloadPatchFailed(PatchProModel.java:2855)
at com.sun.patchpro.server.GroupPatchDownloader.dispatchFailedEvent(GroupPatchDownloader.java:384)
at com.sun.patchpro.server.GroupPatchDownloader.downloadPatchFailed(GroupPatchDownloader.java:335)
at com.sun.patchpro.server.ServerPatchServiceProvider.dispatchFailedEvent(ServerPatchServiceProvider.java:2577
at com.sun.patchpro.server.ServerPatchServiceProvider.validatePatchBundle(ServerPatchServiceProvider.java:2196
at com.sun.patchpro.server.ServerPatchServiceProvider.requestDownload(ServerPatchServiceProvider.java:1780)
at com.sun.patchpro.server.ServerPatchServiceProvider.performDownloadPatches(ServerPatchServiceProvider.java:1
2)
at com.sun.patchpro.server.ServerPatchServiceProvider.downloadPatches(ServerPatchServiceProvider.java:860)
at com.sun.patchpro.server.PatchServerProxy.downloadPatches(PatchServerProxy.java:142)
at com.sun.patchpro.server.GroupPatchDownloader.downloadPatches(GroupPatchDownloader.java:124)
at com.sun.patchpro.model.PatchProModel.performPatchDownload(PatchProModel.java:1932)
at com.sun.patchpro.model.PatchProStateMachine$10.run(PatchProStateMachine.java:526)
at com.sun.patchpro.util.State.run(State.java:266)
at java.lang.Thread.run(Thread.java:595)
So then I attempted to add the patch using patchadd:
# patchadd 122032-03
Validating patches...
Loading patches installed on the system...
Done!
Loading patches requested to install.
Done!
Checking patches that you specified for installation.
Done!
Global patches.
0 Patch 122032-03 is for global zone only - cannot be installed on local zone.
No patches to install.
under /var/sadm/patch/122032-03 on the Global zone, the log shows:
-rw-r--r-- 1 root root 2666 Jan 19 11:19 log
This appears to be an attempt to install the same architecture and
version of a package which is already installed. This installation
will attempt to overwrite this package.
WARNING: /usr/share/lib/zoneinfo/Africa/Timbuktu <no longer a regular file>
WARNING: /usr/share/lib/zoneinfo/America/Argentina/ComodRivadavia <no longer a regular file>
WARNING: /usr/share/lib/zoneinfo/America/Indiana/Indianapolis <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/America/Indianapolis <no longer a regular file>
WARNING: /usr/share/lib/zoneinfo/America/Kentucky/Louisville <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/America/Louisville <no longer a regular file>
WARNING: /usr/share/lib/zoneinfo/CST6CDT <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/EST <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/EST5EDT <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/Europe/Belfast <no longer a regular file>
WARNING: /usr/share/lib/zoneinfo/HST <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/MST <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/MST7MDT <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/PST8PDT <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/Pacific/Yap <no longer a regular file>
Dryrun complete.
No changes were made to the system.
This appears to be an attempt to install the same architecture and
version of a package which is already installed. This installation
will attempt to overwrite this package.
WARNING: /usr/share/lib/zoneinfo/Africa/Timbuktu <no longer a regular file>
WARNING: /usr/share/lib/zoneinfo/America/Argentina/ComodRivadavia <no longer a regular file>
WARNING: /usr/share/lib/zoneinfo/America/Indiana/Indianapolis <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/America/Indianapolis <no longer a regular file>
WARNING: /usr/share/lib/zoneinfo/America/Kentucky/Louisville <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/America/Louisville <no longer a regular file>
WARNING: /usr/share/lib/zoneinfo/CST6CDT <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/EST <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/EST5EDT <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/Europe/Belfast <no longer a regular file>
WARNING: /usr/share/lib/zoneinfo/HST <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/MST <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/MST7MDT <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/PST8PDT <no longer a linked file>
WARNING: /usr/share/lib/zoneinfo/Pacific/Yap <no longer a regular file>
Installation of <SUNWcsu> was successful.
On the non-global zones, either there is nothing under /var/sadm/patch or there isn't even a patch directory under /var/sadm. Is there somewhere else to look?
Thanks.

MARS 6.0.4 reporting for IPS 7.0 Global Correlation Reputation Filtering

Does anyone know if there is a report available in MARS to see what IP addresses were denied by Reputation Filtering on IPS 7.0?
I found a report that shows attacks that were prevented due to global correlation score, but not for packets denied by Reputation Filtering.
Replies are greatly appreciated.
Thanks,
Mark

Thanks for the reply, but what I am looking for is reporting on what packets were dropped with Reputation Filtering(doesn't have a report in MARS) Not the GLobal Correlation risk rating blocks(Which does have a report available in MARS).

Global correlation update

Similar Messages

Maybe you are looking for