Field Notice: FN - 70618 - Cisco Identity Services Engine (ISE) Application Server Might Unexpectedly Restart When Configuration Backup Is Enabled - Software Upgrade Recommended

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Revision History

Revision	Publish Date	Comments
1.0	16-Oct-20	Initial Release
1.1	22-Oct-20	Updated the Defect Information Section

Products Affected

Affected OS Type	Affected Software Product	Affected Release	Affected Release Number	Comments
NON-IOS	Identity Services Engine System Software	2	2.4.0, 2.6.0, 2.7.0	For 2.4.X, all patches up to and including patch 11 For 2.6.X, all patches up to and including patch 6 For 2.7.X, up to and including patch 1

Defect Information

Defect ID	Headline
CSCvs05260	ISE Application server crash/restart due to cancellation of configuration backup

Problem Description

The Cisco Identity Services Engine (ISE) application server might unexpectedly restart when configuration backup is enabled.

Background

The specific trigger for this issue is when an ISE system configuration backup is cancelled while the backup operation is in progress. When this situation occurs, the associated configuration lock files are not completely cleared. As a result, the next time a configuration backup is triggered, a core file is generated and the ISE system restarts the application server without clearing the configuration lock files.

Problem Symptom

For the affected ISE versions, if ISE system configuration backup is cancelled while the backup operation is in progress, all three of the following symptoms will be observed:

• Core files are generated and can be found via the CLI command as shown below. Please note that <hostname> represents the hostname of the ISE system and <pid> represents the process ID number that is unique to each ISE system.
  
  <hostname>/admin# dir disk:/corefiles

Directory of disk:/corefiles
   33522660 Oct 08 2020 10:24:36  core.<hostname>.jsvc.<pid>.gz
   33519169 Oct 08 2020 06:07:24  core.<hostname>.jsvc.<pid>.gz
   33527425 Oct 08 2020 10:27:40  core.<hostname>.jsvc.<pid>.gz
   33526745 Oct 08 2020 10:22:34  core.<hostname>.jsvc.<pid>.gz

           Usage for disk: filesystem 
                38951612416 bytes total used
                1049946939392 bytes free
                1147196649472 bytes available

<hostname>/admin# 
   
• The configuration backup progress is stuck at 0%, as shown in the following image:
  
  
   
• The ISE application log file reflects the following exception:
  
  #show logging application appserver/catalina.out

---------------------------------------------------------------------------
From hs_error file: 
# Problematic frame: 
# C [libc.so.6+0x13e638] __strchr_sse42+0x68 #
---------------------------------------------------------------------------

Workaround/Solution

In order to resolve this issue, upgrade the ISE system software as shown for these releases:

• ISE 2.4 Patch 12 or later 
• ISE 2.6 Patch 7 or later
• ISE 2.7 Patch 2 or later
• ISE 3.0 or later

As a temporary workaround, restart the entire ISE system and perform a configuration backup (manual or scheduled). A full system restart clears the configuration lock files and allows an uninterrupted configuration backup. Do not cancel the configuration backup operation while it is in progress, as it will again lead to unresolved configuration lock files.

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

• Open a service request on Cisco.com
• By email or telephone

Receive Email Notification For New Field Notices

My Notifications—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.