Loading...
Loading...
Checking the logs on the troubleshoot provided, the DAQ seems to have corrupted resulting in one of the instance exiting unexpectedly. This continued very frequently and that resulted in a policy deployment failure as the snort instance was not coming up.
FTD in HA with Snort 2 down.
No workaround yet
** Logs showing snort exiting unexpectedly, Mar 14 22:17:42 SGS-PPL-SRO-2130-FW-02 SF-IMS[8930]: [8930] pm:process [WARN] Process a5cc0f34-a3e8-11e9-acb4-82c1c8451e4c-d04 (22331) exited unexpectedly: 139 (0x0000008B) Mar 14 22:26:32 SGS-PPL-SRO-2130-FW-02 SF-IMS[8930]: [8930] pm:process [WARN] Process a5cc0f34-a3e8-11e9-acb4-82c1c8451e4c-d04 (6204) exited unexpectedly: 139 (0x0000008B) Mar 14 22:31:48 SGS-PPL-SRO-2130-FW-02 SF-IMS[8930]: [8930] pm:process [WARN] Process a5cc0f34-a3e8-11e9-acb4-82c1c8451e4c-d04 (36996) exited unexpectedly: 139 (0x0000008B) Mar 14 22:41:58 SGS-PPL-SRO-2130-FW-02 SF-IMS[8930]: [8930] pm:process [WARN] Process a5cc0f34-a3e8-11e9-acb4-82c1c8451e4c-d04 (31237) exited unexpectedly: 139 (0x0000008B) Mar 14 22:51:58 SGS-PPL-SRO-2130-FW-02 SF-IMS[8930]: [8930] pm:process [WARN] Process a5cc0f34-a3e8-11e9-acb4-82c1c8451e4c-d04 (24130) exited unexpectedly: 139 (0x0000008B) This happened at least 682 times in the troubleshoot provided. 07:03:16 bsunny@tex-59979cb845-6qjkk var-log]# grep -i unexpectedly messages.4 | wc -l 682 ** Logs showing the DAQ was corrupted, Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 snort[16883]: SFHA Input Thread: Connected to /var/sf/run/sfha.sock on socket 10 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[9056]: [17595] sfhassd:local [INFO] LocalInputThread[3]: Local instance connected on socket 10 (PID 16883) Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 snort[16883]: oct_sftls DAQ configured to inline. Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: [16883] oct_sftls_daq:bltd [INFO] DAQLTB Interface Initialized. thread: 23170780721152 sock: /var/sf/localendpoint/sock_ltb mtu: 1518 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: [16883] oct_sftls_daq:bltd [INFO] DAQLTB Channel Opened and Set Non-Blocking Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: [16883] oct_sftls_daq:bltd [INFO] DAQLTB Socket Connection Established Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: [16883] oct_sftls_daq:oct_sftls_daq [INFO] DAQLTB connection established. Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: [16883] oct_sftls_daq:DaqShm [INFO] Shared memory daq_oct_shm-4 map to 0x151259ced000 with size 236000160 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: Queue 3 is running as process 16883 context 0x151298d69600 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: Validating mempool 0x1512cca18318 : Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: Count 2333 Fail Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: node->next: 0x1501390eca10(~0xffffeafec6f135ef) Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: =============0x15019660f800 -- 0x15019660f900 ================ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f800: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 10 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ca Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 0e Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 39 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 01 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 15 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 2e Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 43 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 61 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 01 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 15 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ...9......Ca.... Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f810: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 04 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: e8 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 03 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 0a Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f820: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f830: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f840: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f850: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f860: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f870: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f880: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f890: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f8a0: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f8b0: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f8c0: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f8d0: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f8e0: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 000015019660f8f0: Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: 00 Mar 10 06:44:45 SGS-PPL-SRO-2130-FW-02 SF-IMS[16883]: ................ Mar 10 06:44:46 SGS-PPL-SRO-2130-FW-02 SF-IMS[8930]: [8930] pm:process [WARN] Process a5cc0f34-a3e8-11e9-acb4-82c1c8451e4c-d04 (16883) exited unexpectedly: 139 (0x0000008B) 07:01:13 bsunny@tex-59979cb845-6qjkk var-log]#
Click on a version to see all relevant bugs
Cisco Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.