Scheduling IDS Sensor updates CiscoWorks VMS

I have CiscoWorks VMS setup to auto download new IDS signature files, this works great, however is there a way I can have those signatures automatically installed to my sensors?

Automatic update of signatures is possible with FTP or SCP. You will have to first download the updates from Cisco on to the FTP or SCP server. The sensor will automatically install them.
See here for more inforamtion on Auto upadte feature:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/idmiev/swchap3.htm#wp32902

Similar Messages

MC-IDS - Error Updating Network IDS Signatures

MC for IDS Sensors
Update Network IDS Signatures
Error
Object update failed. The update package provided appears to be corrupt, or permission was denied for reading the file. Please verify the update package contents and retry the operation.
I verified the checksum of 4207248 matches the file I downloaded from CCO. We are running on Solaris. What userid is VMS using to read?
Any ideas ? -jason
root@bnavms # cd/opt/CSCOpx/MDC/etc/ids/updates/
root@bnavms # su jra
root@bnavms # ls -l
-rw-r--r-- 1 jra other 4207248 Jan 7 09:30 IDS-sig-4.1-4-S136.rpm.pkg

You need to get the .zip version of the update. It can be found on the same CCO download page under the IDSMC -> IDS Management Console link at the bottom of the page.

IDS sensor and MC update

Hi,
My organisation uses a Cisco IDS 4215 which i always update from ciscoworks VMS 1.0.3. However, on applying the last update (IDS-sig.4.1.4-S137), it only update the sensor but failed to update the MC. Futhermore, when i telnet to the sensor i could login but there is an error "can not communicate with processes system halted"
Can anyone give me a clue on how wo resolve this problems?.

Hi nkhawaja,
The audit log has the ff errors but does not report anything on MC certificate expiration:
error 1)RDEP Collector (HQ-IDS-01) parsed an evError: errSyslog lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
error 2)RDEP Collector (HQ-IDS-01) parsed an evError: errTransport WebSession::sessionTask(0) TLS connection exception: handshake incomplete.
error 3)RDEP Collector Client RuntimeException :HQ-IDS-01- HTTP connection failed [1,0]
error 4) The update of sensor HQ-IDS-01 was stopped because the MC could not determine the actual version of the sensor.(Communication error)
error 5) HQ-IDS-01.OrganizationName: Error importing sensor version from the sensor - Aborting the CLI command because it has not responded in over 0 hours 30 minutes 10 seconds

Monitoring AES-256 on CiscoWorks VMS 2.3

We want to monitor our AES-256 VPN tunnels for our environment using CiscoWorks VMS 2.3. Our AES-256 VPN peers is a VPN concentrator with multiple PIX firewalls to our remote sites(hub and spoke design). Will CiscoWorks VMS 2.3 support this architecture for VPN monitoring?
Thanks in advance,
Erwin

The management functions for firewalls, Network IPS, Cisco Security Agents, VPNs, security monitoring, and performance monitoring have been updated with new features or usability improvements. Management Center for IDS Sensors is called Management Center for IPS Sensors for its increased IPS focus. The installation of VMS is faster and more streamlined. Management support for router-based IPS signatures has been added to extend security to the network infrastructure.
http://www.cisco.com/en/US/products/sw/cscowork/ps2330/products_installation_guide_chapter09186a00804d137d.html

Scheduling a signature update through MC

How can you schedule a signature update to take place for example at 3:00 in the morning? When I do a signature update through MC, I select the sensor I want to update then click continue and it updates at that time. Can I schedule this somehow? I am using IDS MC and apply updates through the Management Center.Thanks for the help.

Hi,
Any one can help me on this please?
Angshuman

Unable to view IDS logs from cisco VMS server

Hi,
Pls help me out for viewing IDS logs from my cisco vms server (4th edition with SP2,java 1_4_1.02)
Configured IDS sensor with IDS MC (2.0.1) and updated signatures with latest sig files,
Configured Security monitor to view my IDS sensor and showing TLS was connected and cisco IDS REDP/SDEE,when viewing logs error was server codes need to be update., unreconiged last saved IDS alarms.
Pls give me the solution
Regards
Ajay

Hi Ajay,
when you upgrade to sec mon 2.0.1, the database is the same, but the formats are different.. you need to do somethings for converting these formats, which might take hours together, if ur database has too many events...
for information to convert the file format, refer to this URL:
http://www.cisco.com/en/US/products/sw/cscowork/ps3990/prod_release_note09186a0080386f72.html#wp1087204
see the section "Using the ConvertAndImport.pl Script after Upgrading from Security Monitor 1.2.3 to Security Monitor 2.0.1 "
do this and see.. let us know
Raj

IDS sig Updates (IDS-K9-sp-4.1-5-s189.rpm.pkg) Problem

I am trying to upgrade some IDS sensors from S188 to the new service pack which is S189. The IDS device show this message (The System will rebooted upon completion of the update)
After I rebooted the IDS, it still running the old version S188. ANY IDEA why????
Thank you

I don't have the link, but I found the post that solved my problem:
http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1dd90e88/1#selected_message
The link is:
http://www.cisco.com/cgi-bin/tablebuild.pl/ids-patches
But I don't see anything that says "4h" on there. I guess anything beyond patch level "g" should do the trick according to that post.
Hope this helps!!!!!!!!!!
Jim
--UPDATE--
Doesn't look like the link he gave me works. The link below may be more help, but I still don't see that patch.
INSTALLATION
To install the version 4.1(4h) patch on a 4.1(4), 4.1(4a), 4.1(4b)
4.1(4c), 4.1(4d), 4.1(4e), 4.1(4f) or 4.1(4g) sensor, follow these steps:
1. Download the file IDS-K9-patch-4.1-4h.rpm.pkg
to an ftp, scp, http, or https server on your network from:
http://www.cisco.com/cgi-bin/tablebuild.pl/nids
CAUTION: You must log in to Cisco.com using an account with
cryptographic privileges in order to download the file. Do not
change the file name. You must preserve the original file name for
the sensor to accept the update.

IDS Signature Updates

When I update my IDS sensors using the IDS MC 3 of my 4 sensors hang. They never restart all of the services. When I telnet to them I get the message "Error: Cannot communicate with system processes. Please contact your system admi
nistrator.". The IDS MC progress veiwer shows 100% but with errors. It's errors are :Sensor Int_IDS1: Signature Update Process
An error occurred while running the update script on the sensor named Int_IDS1. Detail = An RDEP communication error occurred during the update. Exception message = org.apache.commons.httpclient.HttpRecoverableException: Error in parsing the status line from the response: unable to find line starting with "HTTP"
One sensor works fine with no problems.
I have tried upgrading the sensors individually through IDSMC and the same 3 fail with the same error message. I have tried doing it through command line and ftp and the same 3 fail. The 3 sensors that fail are 4235's and the successful sersor is a 4250 XL.

If you are not running the 'f' patch on your sensors, 4.1.4(f), you should download and install that patch. It fixes some out-of-memory on upgrade issues that are most likely the cause of your problem.
The patch location is posted in another thread.

CiscoWorks VMS Security Monitor competed reports fail to email

Windows Server 2000
VMS 2.2
SecMon 2.2
We periodically have an issue with CiscoWorks VMS Security Monitor Reporting where VMS will stop emailing completed reports. In the past when we reboot the server the email which has been queued up somewhere all gets delivered and the email delivery will work for a few months until it stops again. We rebooted the server this time and the completed reports emails are still not being delivered.
When I test email functionality from the Windows command prompt with blat I can send email from the system through the mail server to my email address. All of the CiscoWorks processes are running without errors.
Where else can I look to troubleshoot this issue?
Thanks in advance

There might be probelm in contacting mail server configured in SecMon
See this URL for Configuring the E-mail Notifications with Scripts for IDS Alerts Using CiscoWorks Monitoring Center for Security:
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_example09186a00801fc770.shtml#maintask1

Schedule task - manager updation for user in oim 11g

Hi,
I am in the way of writing a custom schedule task to update manager for the user created in oim.
I know the procedure of custom scedule task
I want the code snipet to be written in the execute() method of java class to update the manager for the user
Could anybody help me with this!

Hi Gyanprakash,
How will you retrieve the user detail ..?? i am getting null pointer exception error
public void execute(HashMap taskParameters) {
System.out.println("inside the Execute methode");
System.out.println("Schedule task Arguments "+taskParameters);
String userId = (String)taskParameters.get("User Login");
System.out.println("===========input=============== "+userId);
String passwordex=taskParameters.get("usr_pwd_expire_date").toString();
System.out.println("===========input=============== "+passwordex);
String passwordwar=taskParameters.get("usr_pwd_warn_date").toString();
System.out.println("===========input=============== "+passwordwar);
Thanks,
Edited by: Srivatsa.kashyap on May 25, 2012 6:00 AM

Sensors updates aborting

Hello,
I noticed that the last couple of days I was not getting sensor updates. When trying to manually download the updates I got the following error message:
   "Specified user is not authorized for downloading file IPS-CS-MGR-sig-S392-req-E3.zip. Operation aborted."
Because of this I am not getting specific updates.
I have been able to download successfully in the past. Any ideas why this is happening?
Update: I also noticed that it seems to be downloading all the .zip files again after I already have them and is literally taking hours to do. Not sure why this is happening.

Yes, I can manually download the signature package via my CCO login.
The issues is my daily auto updates via my CSM. They aren't auto downloading, applying and deploying, so I'm pretty sure it's not an issue with my IPS devices, however, this is my show stat host info:
General Statistics
   Last Change To Host Config (UTC) = 09-Sep-2010 02:13:21
   Command Control Port Device = Management0/0
Network Statistics
    = ma0_0     Link encap:Ethernet HWaddr 00:00:00:00:00:00
    =           inet addr:x.x.x.x Bcast:x.x.x.x   Mask:x.x.x.x
    =           UP BROADCAST RUNNING MULTICAST MTU:1500   Metric:1
    =           RX packets:802887 errors:0 dropped:0 overruns:0 frame:0
    =           TX packets:325807 errors:0 dropped:0 overruns:0 carrier:0
    =           collisions:0 txqueuelen:1000
    =           RX bytes:108895522 (103.8 MiB) TX bytes:124033185 (118.2 MiB)
    =            Base address:0xbc80 Memory:fcce0000-fcd00000
NTP Statistics
    =       remote           refid      st t when poll reach   delay   offset jitter
     = x.x.x.x   CHU_AUDIO(1)     2 u 947 1024    0    0.000    0.000 4000.00
    = *LOCAL(0)        x.x.x.x      5 l   10   64 377    0.000     0.000   0.001
    = ind assID status conf reach auth condition last_event cnt
    =   1 60484 e000   yes   yes   ok     reject
    =   2 60485   9624   yes   yes none sys.peer   reachable 2
   status = Not Synchronized
Memory Usage
   usedBytes = 1891184640
   freeBytes = 2209161216
   totalBytes = 4100345856
CPU Statistics
   Usage over last 5 seconds = 5
   Usage over last minute = 3
   Usage over last 5 minutes = 3
   Usage over last 5 seconds = 0
   Usage over last minute = 1
    Usage over last 5 minutes = 1
Memory Statistics
   Memory usage (bytes) = 1891184640
   Memory free (bytes) = 2209161216
Auto Update Statistics
   lastDirectoryReadAttempt = N/A
   lastDownloadAttempt = N/A
   lastInstallAttempt = N/A
   nextAttempt = N/A
Auxilliary Processors Installed
I removed the ip/mac address info. It's also not only signatures but all packages associated with IPS
Message was edited by: George Nussbaum

IDS Sensor 4.1 doesn't capture events.

My IDS Sensor 4.1 stops capturing events after some time. I don't know if maybe it is because there are a lot of VLANs in SPAN and the IDS doesn't support all this traffic. Am i wrong?
Here is the show ver output:>
# sh ver
Application Partition:
Cisco Systems Intrusion Detection Sensor, Version 4.1(4)S174
OS Version 2.4.18-5-phoenix
Platform: WS-SVC-IDSM2-BUN
Sensor up-time is 20:49.
Using 337403904 out of 1979682816 bytes of available memory (17% usage)
Using 2.0G out of 17G bytes of available disk space (13% usage)
MainApp 2005_Feb_15_10.32 (Eng4g) 2005-02-15T10:35:34-0600 Running
AnalysisEngine 2005_Feb_15_10.32 (Eng4g) 2005-02-15T10:35:34-0600 Running
Authentication 2005_Feb_15_10.32 (Eng4g) 2005-02-15T10:35:34-0600 Running
Logger 2005_Feb_15_10.32 (Eng4g) 2005-02-15T10:35:34-0600 Running
NetworkAccess 2005_Feb_15_10.32 (Eng4g) 2005-02-15T10:35:34-0600 Running
TransactionSource 2005_Feb_15_10.32 (Eng4g) 2005-02-15T10:35:34-0600 Running
WebServer 2005_Feb_15_10.32 (Eng4g) 2005-02-15T10:35:34-0600 Running
CLI 2004_Apr_15_15.03 (Release) 2004-04-15T15:11:59-0500
Upgrade History:
* IDS-sig-4.1-4-S172 08:51:06 UTC Wed Jun 01 2005
IDS-sig-4.1-4-S174.rpm.pkg 15:13:12 UTC Wed Jun 08 2005
Maintenance Partition Version 2.1(1)
And here is the "sh event" output:
# sh event
evError: eventId=1099377235773324837 severity=warning
originator:
hostId: CISCO-IDS
appName: sensorApp
appInstanceId: 1206
time: 2005/06/10 08:43:21 2005/06/10 10:43:21 GMT
errorMessage: name=errWarning Producer appears to be out of superblocks...consider configuring TCPReassemblyMode to loose FreeBlocks: 2155
evError: eventId=1099377235773324838 severity=warning
originator:
hostId: CISCO-IDS
appName: sensorApp
appInstanceId: 1206
time: 2005/06/10 08:43:23 2005/06/10 10:43:23 GMT
errorMessage: name=errWarning Producer appears to be out of superblocks...consider configuring TCPReassemblyMode to loose FreeBlocks: 2155
But i have already configured TCP Reassembly Mode to 'loose' and it does the same: after some time, it logs a few events and starts logging this event, but the Security Monitor stops showing me any Alarm. What can I do to solve this?
Thank you very much.

When the IDSM2 starts crashing (i mean, logging only this event), i clear the IDSM2 interface counters and i realize that no packet are processed and the "missed packet percentage" grows and grows.
That means after this crashing it stops processing packets and loses every traffic it receives. The question is why? And how can i solve this?
Thanks everybody.

Management Center for IDS Sensors - version error

Hi
Im experiencing problems installing an IDS on CiscoWorks2000 Management Center for IDS Sensors. When I add a sensor I get the following error Error importing configuration files from the sensor - Could not find version in string "Unknown version with discover settings ticked. The sensor is an IDS 4210 version 3.0(5)S17. I have tried to install manually but keep getting sensor not connected in Security monitor.
Thomas

You will usually get this error message when there's a problem with, SSH Fingerprint.
Check the following URL for work around.
http://www.cisco.com/en/US/products/sw/cscowork/ps3990/products_user_guide_chapter09186a0080104f38.html#xtocid6

Schedule line not update thru EDI (VA32/VA33)- DELINS X12-830

Hi,
I am working in EDI X12-830 inbound process for message type DELINS. The inbound process is successfully posted but the problem is, it deletes the old Schedule line and add the current schedule and also I cant find any value in the schedule line tab, it only changes the value in the order quantity in Sales A Tab. My requirement is I need to update the new schedule line coming from the IDOC and keep old schedule line as it. And all the schedule line should updated in the Schedule line Tab of Item (VA32 or VA33).
Thanks

Scheduler and windows update unavailable / unresponsive,

Issue:
Windows Update & Task Scheduler stop working, RDP then fails and a day later the system eventually becomes completely unresponsive and require a reboots to resolve, servers are needing to be rebooted every week on average.
Environment:
Server 2012: all receive same windows updates and have the same running services and applications installed,
all mirror images of DB01
DB01*Displaying Symptoms mentioned below
DB02*fine
DB03*fine
Non Microsoft Services running:
EMC Backup Agent
AVG Antivirus
Enterprise Recon Node - Ground labs
GFI LanGuard 11
BMC Server Automation Agent
WMware Tools Service
Link to Warnings Link to Errors
Symptoms:
Windows Update is not working
(stuck in stopping state, accessing via control panel is unresponsive)
Task Scheduler not working
it shows a stop sign / busy sign (Service is running, cannot see or create scheduled tasks)
RDP eventually stops working.
Above 3 services are started by the same instance (PID) of svchost.exe , killing the svchost.exe instance that started scheduler and windows update services also kills RDP and is not a solution.
Event Logs:
Warnings - https://drive.google.com/file/d/0B4FtPRuE-MzqdFExQi1EdFpQdEk/edit?usp=sharing
Errors - https://drive.google.com/file/d/0B4FtPRuE-MzqMGZzckRwMnFNWGc/edit?usp=sharing

Hi Fraser,
Thank you for your update and patience.
After going through the logs you provided, please check my findings below.
===============================================
Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
Source:        Microsoft-Windows-DeviceSetupManager
Date:          9/3/2014 6:55:47 AM
Event ID:      201
Level:         Warning
User:          SYSTEM
Description:
A connection to the Windows Metadata and Internet Services (WMIS) could not be established.
Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
Source:        Microsoft-Windows-DeviceSetupManager
Date:          8/31/2014 11:37:33 PM
Event ID:      200
Level:         Warning
User:          SYSTEM
Description:
A connection to the Windows Update service could not be established.
Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
Source:        Microsoft-Windows-DeviceSetupManager
Date:          15/08/2013 1:51:01 p.m.
Event ID:      202
Level:         Warning
User:          SYSTEM
Description:
The Network List Manager reports no connectivity to the internet.
Log Name:      System
Source:        DistributedCOM
Date:          9/3/2014 3:10:41 AM
Event ID:      10029
Level:         Error
User:          SYSTEM
Description:
The activation of the CLSID {E60687F7-01A1-40AA-86AC-DB1CBF673334} timed out waiting for the service wuauserv to stop.
Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
Source:        DeviceSetupManager
Date:          9/1/2014 7:26:06 AM
Event ID:      121
Level:         Error
User:          SYSTEM
Description:
Driver install failed, result=0x80072EE2 for devnode 'TERMINPUT_BUS\UMB\2&2C22BCC9&0&SESSION1MOUSE0'
===========
As per my research, those events which related to Device Setup Manager generated because Device Setup Manager just goes out and pings windows update
every night to see if any devices that are installed and set up to use Windows Update to update the corresponding drivers.
Currently, I suggest we make sure the drivers on your server are all up to date via Device Manager. Meanwhile, please try setting up the Windows Update settings from
installing update automatically to manually installing updates. Then restart the server to monitor the issue.
After all the above, if the issue persists, could you please help collect the following information?
=====================================
1. Run the following command and upload the system information.
msinfo32 /nfo      C:\SYSSUM.NFO /categories +systemsummary
2. Does the issue still occur in Clean Boot mode?
If you have any questions or additional information, feel free to let me know.
Thanks for your time.
Best regards,
Sophia Sun
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Scheduling IDS Sensor updates CiscoWorks VMS

Similar Messages

Maybe you are looking for