I've had this issue before. Those are signatures that are enabled in your
policy but have been removed by some XPU. Search for those rule names in your
policy and uncheck them.
-----Original Message-----
From: issforum-bounces@iss.net [mailto:issforum-bounces@iss.net]On
Behalf Of Vijandran S/O Ramasamy
Sent: Tuesday, February 15, 2005 12:04 AM
To: issforum@iss.net
Subject: [ISSForum] ServerSensor Error - Cannot find issue id for
rule...
Hello There,
We have a server installed with Server Sensor 7.0 with XPU 24.2. Every time
the server is restarted or the sensor is restarted, the following error
messages appear in the event viewer:
(sensor name) - Cannot find issue id for rule HTTP_Outlook_Codebase_Execute
(sensor name) - Cannot find issue id for rule SNMP_InvalidTag_Packet
(sensor name) - Cannot find issue id for rule HTTP_IE_HRAlign_Overflow
(sensor name) - Cannot find issue id for rule DNS_WINS_DoS
There's a file called "issuelist.csv" in one of the ISS folders on the
server - when I tried to find the rules above - they don't exist in that
file. Could this be the problem? How do I prevent this error?
Regards,
Vijandran Ramasamy
System Security Department
MAAGNET Systems Sdn Bhd
DISCLAIMER:-
<<This email is confidential and intended only for the use of the individual
or entity named above and may contain information that is privileged. If you
are not the intended recipient, you are notified that any dissemination,
distribution or copying of this email is strictly prohibited. If you have
received this email in error, please notify us immediately by return email
or telephone and destroy the original message. Thank you.>>
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
"MMS <shb.com>" made the following
annotations on 02/15/05 15:10:28
CONFIDENTIALITY NOTICE: This e-mail message including attachments, if any, is
intended for the person or entity to which it is addressed and may contain
confidential and/or privileged material. Any unauthorized review, use,
disclosure or distribution is prohibited. If you are not the intended
recipient, please contact the sender by reply e-mail and destroy all copies of
the original message. Thank you.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
