Running Sensorapp In Single Cpu Mode - Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Installation And Configuration Manual

Appendix B Troubleshooting
Step 4
Step 5
Step 6
Step 7
Step 8

Running SensorApp in Single CPU Mode

Step 1
Cisco Intrusion Detection System Appliance and Module Installation and Configuration Guide Version 4.1
78-15597-02
Replace the virtual sensor file:
cp /usr/cids/idsRoot/etc/defVirtualSensorConfig.xml
/usr/cids/idsRoot/etc/VS-Config/virtualSensor.xml
Remove the cache files:
rm /usr/cids/idsRoot/var/virtualSensor/*.pmz
Exit the service account.
Log in to an account with administrator privileges.
Reboot the sensor:
sensor# reset
Warning: Executing this command will stop all applications and reboot
the node.
Continue with reset? [yes]:yes
Request Succeeded.
sensor#
SensorApp can crash or consume the CPU when running on a dual CPU sensor
with IP logging turned on for the stream-based signatures. You should change to
single processor mode or turn off IP logging for the stream-based signatures. See
CSCed32093 for the more information.
To change the sensor to single processor mode, follow these steps:
Change to single processor mode:
a.
vi ~cids/idsRoot/etc/mainApp.conf
b. Add the following lines at the end of AnalysisEngine section:
Arg01=-t
Arg02=single
This forces the sensorApp to run in single processor mode.
Running SensorApp in single processor mode can cause a drop in
Note
packet-processing performance.
Troubleshooting the 4200 Series Appliance
B-17