Scheduling a signature update through MC

How can you schedule a signature update to take place for example at 3:00 in the morning? When I do a signature update through MC, I select the sensor I want to update then click continue and it updates at that time. Can I schedule this somehow? I am using IDS MC and apply updates through the Management Center.Thanks for the help.

Hi,
Any one can help me on this please?
Angshuman

Similar Messages

  • IDSM2 sig update through IDS MC 2.0

    Hello,
    forgive me if i will stress again about signatures update through VMS IDS version 2.0.
    Since i installed it, i'm experiencing a well known problem related to the following error message:
    Sensor ids-mo-dis-2: Signature Update Process
    An error occurred while running the update script on the sensor named ids-mo-dis-2. Detail = An error occurred at the sensor during the update, sensor message = The host is not trusted. Add the host to the system's trusted TLS certificates.
    Follwing the tips from previous post, i tried to switch between Common Services and CiscoWorks certificates; that trick worked for one sensor but not for the other one (it's a couple of IDSM2 4.1, with the very same configuration).
    Any idea??
    Paolo

    One more clue about my issue.
    I logged into sensor with service account, and I found that file /usr/cids/idsRoot/etc/tls.conf missed of the
    following entry field:
    [CA/foo.mynet.net]
    certFile=foo.mynet.net.cer
    foo.mynet.net is just the hostname of IDS MC console server. After i added it, the upgrade start to work properly. But after i issue the command:
    /etc/init.d/cids restart
    the file tls.conf still lacks of the previously added missing entry.

  • Signature Updates for AIP-SSM 10

    Hi all how can i obtain Signature Updates for AIP-SSM 10 where i am having 60 day trial license with me

    Here is the main file download page for the IPS sensors.
    Find the section for the version you are running and click on the Latest Signature Updates link to take to you to the download page for signature updates.
    You can then download which ever signature update you want.
    NOTE1: Each Signature Updates contains all signatures from previous Sig levels. So you only need to download the latest one.
    NOTE2: Each signature update has a specific E (Engine) level requirement. You can execute "show ver" on your sensor to determine if it is at an E1 or E2 level. If it is at E1 and you want the latest sigs that require E2 then you will first need to install the E2 upgrade.
    On that main download page look for the "Latest Upgrades" link for your version, and look for the IPS-engine-E2-req-X.X-X.pkg file where the X.X-X matches your sensor version.
    If there is not an X.X-X matching your sensor version, then you may need to upgrade the software version for your sensor as well.
    NOTE3: Many of these links will also require an account on cisco.com. And for some of these files that account may also need to be verified for being from a country where the USA's export restrictions allow downloads for encryption. (Most countries qualify but you do have to go through that qualification step). It has been over 10 years that I have had do this so I am not sure of the latest procedures for getting an account or validating it for encrpytion downloads.

  • How to disable scan after signature update in scep 2012 r2?

    I have found that after a reboot of 16 VM's suddenly my SAN had >1000 IOPS on a host with just 16 VM's.
    That might not look bad based on numbers but we still run more or less green and now we have just 16 VM's soon there will be 500+.
    I rebooted the VM's simulating a HA situation and found the huge amount of IOPS for some time.
    MSMPENG.EXE was scanning and we disabled all automatic scanning so I was looking in eventviewer.
    There I discovered a signature update.
    It is highly unwanted to have a partly or full scan on servers. So my question is how can we disabled this?

    Hi,
    I find a scan setting in Antimalware Policy - "Check for the latest definition updates before running a scan". You could check the policy in your SCCM console.
    Please also confirm this is not a scheduled scan.
    Best Regards,
    Joyce
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • IDS Signature Updates

    When I update my IDS sensors using the IDS MC 3 of my 4 sensors hang. They never restart all of the services. When I telnet to them I get the message "Error: Cannot communicate with system processes. Please contact your system admi
    nistrator.". The IDS MC progress veiwer shows 100% but with errors. It's errors are :Sensor Int_IDS1: Signature Update Process
    An error occurred while running the update script on the sensor named Int_IDS1. Detail = An RDEP communication error occurred during the update. Exception message = org.apache.commons.httpclient.HttpRecoverableException: Error in parsing the status line from the response: unable to find line starting with "HTTP"
    One sensor works fine with no problems.
    I have tried upgrading the sensors individually through IDSMC and the same 3 fail with the same error message. I have tried doing it through command line and ftp and the same 3 fail. The 3 sensors that fail are 4235's and the successful sersor is a 4250 XL.

    If you are not running the 'f' patch on your sensors, 4.1.4(f), you should download and install that patch. It fixes some out-of-memory on upgrade issues that are most likely the cause of your problem.
    The patch location is posted in another thread.

  • IPS Signature Updates and CCO logins

    I cannot seem to get my IPS 4255 on version 7.0(3)E4 go gather signature updates and I think it is becasue my CCO accound is not setup correcly. I took a browse through the discussions (admittedly did not read them entirely) but can anyone point me to a discussion on how to setup my CCO account or give me instructions on what I need to do?
    Thank You
    Unprotected,
    Jason Bielenda

    Small correction.
    The URL to create the account is https://tools.cisco.com/RPF/register/register.do
    And you need an IPS services contract to get access to them.
    There are trial licenses available too
    https://tools.cisco.com/SWIFT/LicensingUI/demoPage

  • Cannot upgrade software on sensor due to digital signature update file

    Attached is a jpg of the error message when trying to apply update through IDM for the latest version: 
    IPS-SSM_20-K9-sys-1.1-a-7.0-6-E4.img
    I've downloaded the image twice now from Cisco.  I've done a token reboot but that didnt help.
    I did apply the recovery image right before this with no issues.
    Any ideas?
    Thanks,
    J

    You've experience a very common area of confusion.
    There are multiple different file types of the same version.
    Some of which can be applied through IDM and CLI, and otherwise which can only be applied through other methods.
    Basic Types:
    System Images
    Recovery Packages
    Uprgade Packages
    System Images have "-sys-" in the filename and generally end in .img.
    These files can Not be installed through IDM or the CLI.
    These files will erase the entire compact flash and install a completely new image on the system.
    These files are generally only used when trying to get back to an Older image, or when you believe that the current image on the sensor has been Corrupted.
    They are not recommended for upgrading as the configuration of the sensor will be completely removed during erasing of the compact flash.
    They are installed through either ROMMON (on appliances), from the hw-module recover command of the ASA (on ASA IPS modules), through the bootloader (on AIM and NME router modules), or through the maintenance partition (in the IDSM2 Cat 6K module).
    In your case it was a System Image you were trying to install through IDM, which is not allowed.
    Recovery Packages have "-r-" in the filename and end in .pkg.
    They will re-image the Recovery partition of the sensor.
    They are installed using IDM or the CLI upgrade command.  (.pkg files work with the Upgrade command)
    The "recover" command on the sensor can then be used to boot to the Recovery Partition and re-image the Application partition to that version.
    The "recover" can be done from a remote box through an SSH connection to the sensor.  Unlike System Images which often require a Console connection or connection to the hosting device.
    Recovery Packages are recommended when you believe that the current image on the sensor has been Corrupted.
    They can often be used for Downgrading to an older version, but this is not officially supported (and will sometimes fail, if it fails then you need to use a System Image instead).
    Upgrade Packages come in different types.
    Major, Minor, and Service Pack upgrade files do not have a designator in their name, and usually just have the platform and version.
    Signature Updates have "-sig-" in the name.
    Engine Updates have "-engine-" in the name.
    All Upgrade Packages end in .pkg.
    Upgrade Packages can be installed using IDM or the CLI upgrade command.
    In your situation you want to download the Upgrade file for 7.0-6-E4 instead of the System Image file.
    Because the SSM-20 has the common architecture it will use the standard upgrade file that does not list the platform name.
    The package you want is IPS-K9-7.0-6-E4.pkg.

  • OOB warning during IPS 4260 signature update via CSM

    Hi,
    During the recent IPS signatures updates via CSM, i have noticed that there was warning (below).
    >OOB change detected - Out of Band(OOB)and sensor configuration change happened on device. But you selected to continue deployment in case of OOB. Continuing...
    what is the cause & impact of such event?
    As i suspected there is a mismatch of configuration, my inline interfaces are no longer applied to the virtual sensor 'VS0'. Could it be due to the mis-synchronisation?
    Apprepriate for any advice.
    thanks
    cash

    CSM keeps an internal copy of the configuration it last pushed to the sensor.
    Each portion of the configuration has a configToken assigned to it by the sensor. The config token is a base 64 encoding of that configuration portion.
    Each time CSM goes to push a new configuration it will compare the configToken of it's previously saved configuration for that sensor against the configToken of the configuration currently on the sensor.
    If the 2 configTokens match, then no configuration change has been made since the last time that CSM pushed a configuration to the sensor. CSM can safely push the new configuration to the sensor.
    If the 2 configTokens do not match, then an Out Of Band (OOB) configuration change has been made to the sensor. This means that the sensor's configuration has been modified by something other than CSM. This may have been a user changing something through the CLI or IDM instead of using CSM.
    In these situations CSM gives you the option of either stopping the push of the new configuration so the detected changes can be imported and evaluated by the user, or to go ahead and push the changes to the sensor.
    If you decide to go ahead and push the changes to the sensor, the outcome of the configuration change is not guaranteed.
    The sensor may wind up merging the OOB changes in with the new configuration from CSM, or the CSM changes may wind up overwriting the OOB changes.
    So telling CSM to push the new configuration even when OOB changes have been detected can be risky and can cause loss of some of your configuration.
    I fyou will be making changes with CLI or IDM, then it is always best to import those changes into CSM before making further configuration changes in CSM.

  • Installing signature update for IDSM-2 on AIP-SSM

    Hi every one,im not sure about this question but i think its beter to ask you experts.i want to know that if i have signature update for example for my IDSM-2 can i instal this sig update on my AIP-SSM --> suppose that IPS software on both devices are same and also i have installed valid license key on AIP-SSM.now can i do this or no? and i know that if you have not valid license installed on IDSM-2 you cant instal any sig update on IDSM-2 but what about AIP-SSM?i mean can i instal sig update on AIP-SSM without installed valid license key on AIP-SSM? thanks

    There are 3 main types of Signature Updates.
    1) IPS Sensor Signature Updates
    2) CSM Signature Updates for IPS Sensors
    3) IOS IPS Signature Updates
    The IPS Signature Update filename is in the form: IPS-sig-Sxxx-req-Ey.pkg
    This is most likely what you are referrnig to in your post. This file can be installed on ANY IDS/IPS Appliance or Module.
    The Requirement here is not the platform but rather the Engine Level. The "req-Ey" portion of the filename tells you that the sensor must already be running the "y" Engine level of software.
    So an IPS-sig-S436-req-E3.pkg file can be installed on any IDS/IPS Appliance or Module so long as the software on that sensor is an "E3" version.
    The CSM updates, are signature updates for the Cisco Security Manager. They contain special files that CSM uses to update itself, and then also included within the CSM update is the actual sensor update described above. CSM unpackages the CSM update, updates itself, and then uses that embedded file to upgrade the actual sensor.
    The third type of file is for IOS Routers loaded with special IOS software that has the special IOS IPS features where the Router itself (instead of a separate IDS/IPS module) does the signature monitoring.
    These IOS IPS Signature Updates get installed on the actual router, and are not installed on the IDS/IPS Sensor Appliances or Modules.
    So in answer to your question, yes the same Signature Update for your IDSM-2 is the exact same Signature Update for your SSM modules.
    The exact same file is available through multiple different paths on cisco.com. But it doesn't matter through which cisco.com path you downloaded the file you can still install it on all IDS/IPS Appliances and Modules.
    As for licensing, the license works the same on all IDS/IPS Appliances and Modules. A license must be on the sensor for the Signature Update to be applied.
    NOTE: A Trial License is available from cisco.com for new sensors to allow you time to get everything setup correctly for your sensor to be covered by a service contract, and get the standard license from the service contract.

  • How often ARE those IPS virus signatures updated?

    I was looking at a "show version" on one of my current sensors and noticed that the last virus signature was over 7 months ago. Now, one of the big reasons I was told we had to pay for our 5.x licenses was these virus signatures. If that's true, and this is the additional value Trend Micro has brought to our sensors, should they get updated a little more frequently?
    (from my sensor)
    Cisco Intrusion Prevention System, Version 5.1(1p1)S235.0
    Host:
    Realm Keys key1.0
    Signature Definition:
    Signature Update S235.0 2006-06-22
    Virus Update V1.2 2005-11-24

    The Virus Signature from Trend was one reason for the licensing in 5.x, but was not the only reason and was not even the primary reason.
    Even as far back as version 2.x a Support Contract was required for downloading and installation of signature updates. But was not enforced by the software. We relied on the users keeping the support contracts up to date on their own. Many users downloaded and installed signature updates without paying for the support contract. And the vast majority did not realize that a support contract was needed to receive the signature updates.
    With the lack of support contract purchases it became difficult to continue fielding a team for writing IPS signature updates.
    So in version 5.x it was decided to begin enforcing the purchase of support contracts through the use of Signature Update Licenses as part of the Cisco Service for IPS Contracts. Thus ensuring funding for the signature team, and allowing the team to spread out world wide for 24 hour coverage.
    The additional cost of a Cisco Service for IPS contract when compared to standard SmartNET contracts for other Cisco products is for the specific funding of the Cisco signature team, and a small amount sent to Trend for assistance in signature creation. Only a small portion of the support contract is paid to Trend Micro for their support.
    The Virus signatures are part of the Cisco Incident Control System (Cisco ICS). With the purchase of ICS there is a faster deployment of signature for Virus/Worms. When a virus or worm reaches a critical level then TrendMicro can create their own Virus signatures and have Cisco ICS deploy those signature to the sensors as soon as they are written.
    Cisco then includes these Virus signatures in a later standard Cisco signature update.
    Now as for why there have not been any recent updates to the Virus Signatures is that there has not been a major out break in the past 6/7 months. The virus signatures are only created on an emergency basis when a virus or worm reaches a critical level. Cisco ICS was specifically designed for handling virus and worm outbreaks, and is referred to as Outbreak Prevention.
    If the virus/worm does not reach a critical level, then the emergency Virus signatures are not created.
    Instead the Cisco signature team will take care of them as part of the standard Cisco signatures that are included as part of the standard S updates.
    This doesn't mean that we are not receiving information from Trend. For Virus/Worms that do not reach that critical level, the Trend team will instead send information to Cisco for creation of standard Cisco signatures by the Cisco signature team. This way the Cisco team can create a mroe general signature designed to catch all attacks for a certain vulnerability that will catch that specific virus/worm as well as future virus/worms that may also attempt to exploit the same vulnerability. These signatures wind up as part of the standard S update. This method is used because the Cisco signature team has more in depth knowledge of the various engines in Cisco IPS and can often write signatures that the Trend engineers would not be able to.
    It is only when the Trend Micro engineers need to create an emergency update that they will create their V signatures for the specific virus/worm.
    Otherwise they share share the information with Cisco and the Cisco engineers creates the signature.

  • Scheduler and windows update unavailable / unresponsive,

    Issue:
    Windows Update & Task Scheduler stop working, RDP then fails and a day later the system eventually becomes completely unresponsive and require a reboots to resolve, servers are needing to be rebooted every week on average.
    Environment:
    Server 2012: all receive same windows updates and have the same running services and applications installed,
    all mirror images of DB01
    DB01*Displaying Symptoms mentioned below
    DB02*fine
    DB03*fine
    Non Microsoft Services running:
    EMC Backup Agent
    AVG Antivirus
    Enterprise Recon Node - Ground labs
    GFI LanGuard 11
    BMC Server Automation Agent
    WMware Tools Service
    Link to Warnings Link to Errors
    Symptoms:
    Windows Update is not working
    (stuck in stopping state, accessing via control panel is unresponsive)
    Task Scheduler not working
    it shows a stop sign / busy sign (Service is running, cannot see or create scheduled tasks)
    RDP eventually stops working.
    Above 3 services are started by the same instance (PID) of svchost.exe , killing the svchost.exe instance that started scheduler and windows update services also kills RDP and is not a solution.
    Event Logs:
    Warnings - https://drive.google.com/file/d/0B4FtPRuE-MzqdFExQi1EdFpQdEk/edit?usp=sharing
    Errors - https://drive.google.com/file/d/0B4FtPRuE-MzqMGZzckRwMnFNWGc/edit?usp=sharing

    Hi Fraser,
    Thank you for your update and patience.
    After going through the logs you provided, please check my findings below.
    ===============================================
    Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
    Source:        Microsoft-Windows-DeviceSetupManager
    Date:          9/3/2014 6:55:47 AM
    Event ID:      201
    Level:         Warning
    User:          SYSTEM
    Description:
    A connection to the Windows Metadata and Internet Services (WMIS) could not be established.
    Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
    Source:        Microsoft-Windows-DeviceSetupManager
    Date:          8/31/2014 11:37:33 PM
    Event ID:      200
    Level:         Warning
    User:          SYSTEM
    Description:
    A connection to the Windows Update service could not be established.
    Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
    Source:        Microsoft-Windows-DeviceSetupManager
    Date:          15/08/2013 1:51:01 p.m.
    Event ID:      202
    Level:         Warning  
    User:          SYSTEM
    Description:
    The Network List Manager reports no connectivity to the internet.
    Log Name:      System
    Source:        DistributedCOM
    Date:          9/3/2014 3:10:41 AM
    Event ID:      10029
    Level:         Error  
    User:          SYSTEM
    Description:
    The activation of the CLSID {E60687F7-01A1-40AA-86AC-DB1CBF673334} timed out waiting for the service wuauserv to stop.
    Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
    Source:        DeviceSetupManager
    Date:          9/1/2014 7:26:06 AM
    Event ID:      121
    Level:         Error  
    User:          SYSTEM
    Description:
    Driver install failed, result=0x80072EE2 for devnode 'TERMINPUT_BUS\UMB\2&2C22BCC9&0&SESSION1MOUSE0'
    ===========
    As per my research, those events which related to Device Setup Manager generated because Device Setup Manager just goes out and pings windows update
    every night to see if any devices that are installed and set up to use Windows Update to update the corresponding drivers.
    Currently, I suggest we make sure the drivers on your server are all up to date via Device Manager. Meanwhile, please try setting up the Windows Update settings from
    installing update automatically to manually installing updates. Then restart the server to monitor the issue.
    After all the above, if the issue persists, could you please help collect the following information?
    =====================================
    1. Run the following command and upload the system information.
    msinfo32 /nfo      C:\SYSSUM.NFO /categories +systemsummary
    2. Does the issue still occur in Clean Boot mode?
    If you have any questions or additional information, feel free to let me know.
    Thanks for your time.
    Best regards,
    Sophia Sun
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

  • Heads up on Win 8 Virus SIgnature Update behaviour

    If you are using the built-in Windows Defender AV solution In Windows 8, be aware that there are reports emerging that if Windows Updates are set to notify, then virus signature updates are forced to have the same setting, and won't install automatically.
    There appears to be a workaround by using the Win 8 scheduler to explicitly run a signature update process with the command...
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -signatureUpdate"
    More on this as further detail becomes evident.
    Cheers,
    Bill
    I don't work for Lenovo

    Wolfyk wrote:
    So should i have it set to notify or not?
    If you don't have "everything automatic", doesn't matter what you choose.
    But it's not an issue. It doesn't happen. Is eeeeeverything on your mind: http://answers.microsoft.com/en-us/windows/forum/w​indows_8-windows_update/windows-update-tile-deskto​...
    If I helped you, please give me some kudos! ^^

  • Reporting for System Center End point Protection -Antivirus Infections,Signature updates,Errors/failures

    Hi,
    We have SCEP on all servers 2008 R2 and 2012, now basically we are loking for specific information on
    infections
    Signature Updates
    Errors/Failures.
    Regards,
    gautham.K
    MCTS-Microsoft Exchange Adminstrator,2010

    The Antimalware activity report cover your 1 request.
    The Computer Endpoint Protection status covers the other two request, it is a drill through for the other reports and it is within a hidden folder.
    Garth Jones | My blogs: Enhansoft and
    Old Blog site | Twitter:
    @GarthMJ

  • AIP-SSM-10 signature update failure

    Hopefully someone will be able to help me, I am unable to get the IPS signature autoupdate working on our ASA 5510. We have a valid support contract, our username does not incude and special characters and I am able to download the signature files from the website using our CCO.
    When trying to get them via Auto/cisco.com update though I get the following in the event logs every update attempt:
    evError: eventId=1319467413849005289  vendor=Cisco  severity=error 
      originator:  
        hostId: xxxx 
        appName: mainApp 
        appInstanceId: 354 
      time: Oct 26, 2011 11:40:01 UTC  offset=60  timeZone=GMT00:00 
      errorMessage: AutoUpdate exception: HTTP connection failed [1,111]  name=errSystemError 
    I have included a "show conf" and a "show stat host" below.
    <snip>
    xxxxxx# show conf
    ! Current configuration last modified Wed Oct 26 10:48:07 2011
    ! Version 7.0(6)
    ! Host:
    !     Realm Keys          key1.0
    ! Signature Definition:
    !     Signature Update    S604.0   2011-10-20
    service interface
    exit
    service authentication
    exit
    service event-action-rules rules0
    exit
    service host
    network-settings
    host-ip 10.x.x.x/24,10.x.x.x
    host-name xxxxxx
    telnet-option disabled
    access-list 10.x.x.x/32
    access-list 10.x.x.x/16
    access-list 10.x.x.x/32
    dns-primary-server enabled
    address 10.x.x.x
    exit
    dns-secondary-server disabled
    dns-tertiary-server disabled
    exit
    time-zone-settings
    offset 0
    standard-time-zone-name GMT00:00
    exit
    ntp-option enabled-ntp-unauthenticated
    ntp-server 10.x.x.x
    exit
    summertime-option recurring
    summertime-zone-name GMT00:00
    start-summertime
    week-of-month last
    exit
    end-summertime
    month october
    week-of-month last
    exit
    end-summertime
    month october
    week-of-month last
    exit
    exit
    auto-upgrade
    cisco-server enabled
    schedule-option periodic-schedule
    start-time 00:40:00
    interval 1
    exit
    user-name xxxxxxxxxxxxxxx
    cisco-url https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl
    exit
    exit
    exit
    service logger
    exit
    service network-access
    exit
    service notification
    exit
    service signature-definition sig0
    exit
    service ssh-known-hosts
    exit
    service trusted-certificates
    exit
    service web-server
    exit
    service anomaly-detection ad0
    exit
    service external-product-interface
    exit
    service health-monitor
    exit
    service global-correlation
    exit
    service aaa
    exit
    service analysis-engine
    virtual-sensor vs0
    physical-interface GigabitEthernet0/1
    exit
    exit
    <snip>
    xxxxxx# show stat host
    General Statistics
       Last Change To Host Config (UTC) = 27-Oct-2011 08:27:10
       Command Control Port Device = GigabitEthernet0/0
    Network Statistics
        = ge0_0     Link encap:Ethernet  HWaddr 00:12:D9:48:F7:44
        =           inet addr:10.x.x.x  Bcast:10.x.x.x.x  Mask:255.255.255.0
        =           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
        =           RX packets:470106 errors:0 dropped:0 overruns:0 frame:0
        =           TX packets:139322 errors:0 dropped:0 overruns:0 carrier:0
        =           collisions:0 txqueuelen:1000
        =           RX bytes:40821181 (38.9 MiB)  TX bytes:102615325 (97.8 MiB)
        =           Base address:0xbc00 Memory:f8200000-f8220000
    NTP Statistics
        =      remote           refid      st t when poll reach   delay   offset  jitter
        = *time.xxxx.x 195.x.x.x   3 u  142 1024  377    1.825   -0.626   0.305
        =  LOCAL(0)        LOCAL(0)        15 l   59   64  377    0.000    0.000   0.001
        = ind assID status  conf reach auth condition  last_event cnt
        =   1 43092  b644   yes   yes  none  sys.peer   reachable  4
        =   2 43093  9044   yes   yes  none    reject   reachable  4
       status = Synchronized
    Memory Usage
       usedBytes = 664383488
       freeBytes = 368111616
       totalBytes = 1032495104
    Summertime Statistics
       start = 03:00:00 GMT00:00 Sun Mar 27 2011
       end = 01:00:00 GMT00:00 Sun Oct 30 2011
    CPU Statistics
       Usage over last 5 seconds = 51
       Usage over last minute = 44
       Usage over last 5 minutes = 50
    Memory Statistics
       Memory usage (bytes) = 664383488
       Memory free (bytes) = 368111616
    Auto Update Statistics
       lastDirectoryReadAttempt = 08:40:00 GMT00:00 Thu Oct 27 2011
        =   Read directory: https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl
        =   Error: AutoUpdate exception: HTTP connection failed [1,111]
       lastDownloadAttempt = N/A
       lastInstallAttempt = N/A
       nextAttempt = 09:28:00 GMT00:00 Thu Oct 27 2011
    Auxilliary Processors Installed
    <snip>
    Many thanks.

    Hi Bob,
    Thanks for the reply - it got me thinking about how it was actually getting the update.
    I needed to modify an ACL and add a PAT for the sensor management IP as I've tied down the hosts that can get out.
    It's now showing that it is attempting to reach the URL - currently there aren't any updates waiting though....
    Many thanks.

  • IPS Signature Updates

    My customer did not install any signature updates in 2011. He is now ready to begin a scheduled update procedure. My question is: Are the updates cumulative, i.e., by upgrading today am I getting all the past signatures from the latest (s615 as of today)/

    Yes the signature updates are cumulative, but they do depend upon a minimum version of software. If you are already running any E4 release you can jump to the end of the signature update line and install S615.
    - Bob

Maybe you are looking for