2 Replies Latest reply on Nov 1, 2013 10:58 AM by Evandro Rodrigues

    DNS Cache

    Evandro Rodrigues

      Hello All!

       

      There is a message appearing in ems.log for a long time. It says: "Date Time INFO [DNSLookupQueueThread] iv.core.dnslookupCache - Max Cache Size reached: 200000"

       

      What is this message about?

      NSM 7.5.5.6

      IPS Sensor Software: 7.5.3.30

       

      All features about DNS are disabled, because the sensors are not authorized to consult DNS Servers yet.

       

      Thanks,

      Evandro.

        • 1. Re: DNS Cache

          We're currently tracking an issue where the manager still does DNS lookups at 7.5 despite being configured not to do so.  It sounds like that is what you are running into.


          There is a database option that can be disabled by manually logging into MySql and executing the below command:

           

          mysql -uroot -p lf

           

          update iv_emsproperties set value='false' where name like '%iv.dnslookup.realtime.lookup.enable%';

           

           

           

           

          We have seen it cause issues with alert processing on the manager, which is likely related to your other query.

          • 2. Re: DNS Cache
            Evandro Rodrigues

            Hello Fergus!

            Thanks about the this information. Very important!

            I´ll execute this command and after that, take a loot at ems.log.

             

            And i´ll check about the other issue too. (Error Notifying Update)