Dear Cisco Customer,

Cisco engineering has identified the following software issue with the release you installed that may affect your use of this software. Please review the Software Advisory notice here to determine if the issues apply to your environment.

Affected Software and Replacement Solution for CSCvb26230

Software Type

Software Affected

Software Solution

FireSIGHT Software

Version:

FireSIGHT System Version 5.4.0.9

Affected Images:

·         Cisco_Network_Sensor_Upgrade-5.4.0.9-39.sh

Version:

·         Cisco Firepower Appliance Sensor Hotfix DK

·         FireSIGHT Version 5.4.0.11, or the latest patch

Replacement Images:

·         Cisco_Network_Sensor_ Hotfix_DK-5.4.0.10-1.sh

Problem Description:

This software advisory addresses CSCvb26230. ASA 5500-X with FirePOWER Services modules running FireSIGHT System Version 5.4.0.9 experience excessive logging, system performance degradation, and limited storage.

Affected Platforms:

Platforms running FireSIGHT System Version 5.4.0.9:

·         ASA 5500-X with FirePOWER Services modules (ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, and ASA 5555-X)

Symptom:

Excessive logging causes disk space issues, system performance degradation, and limited storage. These symptoms may directly affect your system functionality.

Example of the excess, persistent logging:

Jan 11 20:36:48 asa5515 SF-IMS[3130]: [23250] SFDataCorrelator:URLUserIP_CorrelatorThread [INFO] Unique id message received

Jan 11 20:36:48 asa5515 SF-IMS[3130]: [23250] SFDataCorrelator:URLUserIP_CorrelatorThread [INFO] Instance ID value received is 2

Jan 11 20:36:48 asa5515 SF-IMS[3130]: [23250] SFDataCorrelator:URLUserIP_CorrelatorThread [INFO] Succesfully added instance information to instance_map

Jan 11 20:36:48 asa5515 SF-IMS[3130]: [23251] SFDataCorrelator:URLUserIP_CorrelatorThread [INFO] Unique id message received

Conditions:

Sensors running FireSIGHT System Version 5.4.0.9

Workaround:

·         Apply Cisco Firepower Appliance Sensor Hotfix DK to the affected platforms during a scheduled maintenance window.

Note: Install the hotfix during a scheduled maintenance window as the installation causes brief traffic disruption.

·         Update the system to FireSIGHT System Version 5.4.0.11, or the latest patch.

How to Identify the Software Issue:

To identify whether your appliance is running the affected version, execute the show version CLI command.

Example:

> show version

--------------------[ asa5515 ]---------------------

Model                     : ASA5515 (72) Version 5.4.0.9 (Build 39)

UUID                      : f6a5311e-7cc8-11e6-8de9-a110d3d87ee4

VDB version               : 211

----------------------------------------------------