Verifying Arc Is Running; Verifying Arc Connections Are Active - Cisco IPS 7.1 Installation Manual

Appendix E Troubleshooting
For More Information
•
•
•
•
•

Verifying ARC is Running

Note The CLI output is an example of what your configuration may look like. It will not match exactly due to
the optional setup choices, sensor model, and IPS 7.1 version you have installed.
To verify that the ARC is running, use the show version command. If the MainApp is not running, the
ARC cannot run. The ARC is part of the MainApp.
To verify that the ARC is running, follow these steps:
Log in to the CLI.
Step 1
Verify that the MainApp is running.
Step 2
sensor# show version
Application Partition:
Cisco Intrusion Prevention System, Version 7.1(3)E4
Host:
Signature Definition:
OS Version:
Platform:
Serial Number:
No license present
Sensor up-time is 13 days.
Using 4395M out of 5839M bytes of available memory (75% usage)
system is using 26.2M out of 160.0M bytes of available disk space (16% usage)
application-data is using 69.7M out of 171.6M bytes of available disk space (43%
usage)
boot is using 57.3M out of 70.5M bytes of available disk space (86% usage)
application-log is using 494.0M out of 513.0M bytes of available disk space (96%
usage)
MainApp
6-0600
AnalysisEngine
6-0600
CollaborationApp
6-0600
CLI
6-0600
OL-24002-01
For the procedure to verify that ARC is running, see
For the procedure to verify that ARC is connecting, see
page E-38.
For the procedure to verify that the Event Action is set to Block Host, see
for a Signature, page E-42.
For the procedure to verify that the master blocking sensor is properly configured, see
Master Blocking Sensor Configuration, page
For a discussion of ARC architecture, refer to
Realm Keys key1.0
Signature Update S605.0
2.6.29.1
ASA5585-SSP-IPS10
123456789AB
S-2011_NOV_16_00_20_7_1_3_46
Running
S-2011_NOV_16_00_20_7_1_3_46
Running
S-2011_NOV_16_00_20_7_1_3_46
Running
S-2011_NOV_16_00_20_7_1_3_46
Cisco Intrusion Prevention System Appliance and Module Installation Guide for IPS 7.1
Troubleshooting the Appliance
Verifying ARC is Running, page

Verifying ARC Connections are Active,

E-43.
Attack Response Controller.
2011-10-25
(Release) 2011-11-16T00:23:0
(Release) 2011-11-16T00:23:0
(Release) 2011-11-16T00:23:0
(Release) 2011-11-16T00:23:0
E-37.
Blocking Not Occurring
Verifying the
E-37