Thread Info
  • State Suggested Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 62 replies
  • Answers 2 answers
  • Subscribers 37 subscribers
  • Views 191045 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SFOS 16.01.0 known IPS issue - Work arounds?

Darrian Churchill

Hey all,

Anyone have any other work around for the known IPS issue (NC-8238   [IPS] IPS Service drops legitimate traffic in very high load average conditions)? The IPS service seems to constantly fail to start and causes this issue from what I can see (CPU usage and memory usage spike all over the place). As my work around, I set the IPS service to Stop, performance and traffic return to normal. Obviously this isn't a great solution... Anyone have anything better? 

I'd like to know when this will be resolved too, seems to me to be a rather big problem. I may actually just roll back to 15 if this is going to be a thing for a while.

Thanks !!



This thread was automatically locked due to age.
Parents
  • +1

    HI All

    I may have a Work aournd  by changing the IPS settings , As this is a Workaround

    Default IPS settings

    stream on
    lowmem off
    maxsesbytes 0
    maxpkts 100
    enable_appsignatures on
    http_response_scan_limit 65535

    Run Commands on Console 

    set ips maxsesbytes-settings update 8192
    set ips maxpkts 8

    IPS settings after changes 

    -------------IPS Settings-------------
    stream on
    lowmem off
    maxsesbytes 8192
    maxpkts 8
    enable_appsignatures on
    http_response_scan_limit 65535

     This should help..

  • 0 in reply to Aditya Patel

    I've just installed SFOS 16.05.1 MR-1 and the issue seems to be fixed. I will monitor for a couple days and reply again, but it does look like its a lot better already - the service stays running now instead of flapping up and down. 

    Will be sure to reply again with feedback in a couple days.

  • 0 in reply to Darrian Churchill

    Thanks for letting us know Darrian - is this a BETA release? My appliances say 'no updates available' for 16.01.2

Reply Children