Field Notice: FN - 72303 - Firepower Software - Firepower Management Center MonetDB Database Might Crash and Cause Loss of Connection Events - Software Upgrade Recommended

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Revision History

Revision	Publish Date	Comments
2.0	25-Jul-22	Updated the Products Affected, Background, Problem Symptom, and Workaround/Solution Sections
1.0	15-Mar-22	Initial Release

Products Affected

Affected OS Type	Affected Software Product	Affected Release	Affected Release Number	Comments
NON-IOS	Firepower Management Center Software	6.6	6.6.0, 6.6.0.1, 6.6.1, 6.6.3, 6.6.4, 6.6.5, 6.6.5.1, 6.6.5.2
NON-IOS	Firepower Management Center Software	6.7	6.7.0, 6.7.0.1, 6.7.0.2, 6.7.0.3
NON-IOS	Firepower Management Center Software	7.0	7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1

Defect Information

Defect ID	Headline
CSCvu18510	MonetDB's eventdb crash causes loss of connection events on FMC
CSCvv21045	Database may stop accepting new connections causing event processing to stop

Problem Description

The Firepower Management Center (FMC) MonetDB event database might crash, which results in the loss of connection events.

Background

The FMC supports the import of event files into the MonetDB database in the CSV file format. This might result in a crash of the event database and loss of connection event detection for some versions of Firepower software.

Problem Symptom

For Cisco bug ID CSCvu18510, the error messages contained in the "merovingian.log" log file on the FMC indicate "strPut" and "UTF-8" after the MonetDB crash.

/var/log/monetdb/merovingian.log:
…
2022-01-10 12:15:10 ERR eventdb[18129]: #main thread:!ERROR: strPut: incorrectly encoded UTF-8
2022-01-10 12:15:10 ERR eventdb[18129]: !mvc_init: unable to create system tables
2022-01-10 12:15:10 ERR eventdb[18129]: #main thread:!ERROR:SQLException:SQLinit:42000!Catalogue initialization failed
2022-01-10 12:15:10 ERR eventdb[18129]: Fatal error during initialization:
2022-01-10 12:15:10 ERR eventdb[18129]: SQLException:SQLinit:42000!Catalogue initialization failed
…
2022-01-10 12:15:10 MSG eventdb[18129]: # Listening for UNIX domain connection requests on mapi:monetdb:///Volume/lib/monetdb/dbfarm/eventdb/.mapi.sock
2022-01-10 12:15:10 MSG merovingian[13887]: database 'eventdb' (18129) has exited with exit status 1
2022-01-10 12:15:10 ERR control[13887]: !monetdbd: an internal error has occurred 'database 'eventdb' has crashed after starting, manual intervention needed, check monetdbd's logfile (/var/log/monetdb/merovingian.log) for details'
2022-01-10 12:15:10 MSG merovingian[13887]: database 'eventdb' has crashed after start on 2022-01-10 12:15:05, attempting restart, up min/avg/max: 1w/1w/1w, crash average: 1.00 1.00 1.00 (55351-1=55350)
2022-01-10 12:15:10 ERR merovingian[13887]: client error: database 'eventdb' has crashed after starting, manual intervention needed, check monetdbd's logfile (/var/log/monetdb/merovingian.log) for details

For related Cisco bug ID CSCvv21045, the error messages contained in the "merovingian.log" log file on the FMC indicate "THRcreate: semaphore name is too large" after the MonetDB crash.

/var/log/monetdb/merovingian.log:
…
2022-01-10 12:15:15 ERR eventdb[28136]: #client37788:!ERROR: THRcreate: semaphore name is too large

Workaround/Solution

Cisco recommends to upgrade the Firepower software to one of the versions shown in this table to fix both Cisco bug ID CSCvu18510 and Cisco bug ID CSCvv21045.

Release Version	Fixed Version
6.6.0, 6.6.0.1, 6.6.1, 6.6.3, 6.6.4, 6.6.5, 6.6.5.1, 6.6.5.2	6.6.7 or later
6.7.0, 6.7.0.1, 6.7.0.2, 6.7.0.3	7.0.2 or later
7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1	7.0.2 or later

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

• Open a service request on Cisco.com
• By email or telephone

Receive Email Notification For New Field Notices

My Notifications—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.