This means that the policy contains rules/settings for an event that the sensor has no support for. Usually, this simply translates to the policy being of a higher (newer) XPU than the sensor.
As a first step, apply the latest XPU's to the sensor and see if it solved the problem. Otherwise, I'd recommend a clean install, which is so simple that I've never bothered to restore a sensor backup anyway. Just install the IPSO NS7 package (get it from ISS download site), don't borrow anything from another box except for TRONS rules and user-defined files - this should take ~10 minutes. Manage the sensor and temporarily apply a blank policy to keep the noise down. Apply XPU's until you're current (usually three: one each of 20.x, 21.x and 22.x). Finally, edit your properties/settings and apply your production policy and response. Note: I find that doing many PAM settings through the GUI is slow and it's usually a lot easier to cut & paste PAM settings from another sensor or a template configuration file. Just make sure to stop/start the sensor when you're editing. Cheers, Robert -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: 14 October 2004 21:13 To: [EMAIL PROTECTED] Subject: [ISSForum] The policy file is newer than issues.csv Hi everyone, I�m having trouble with a 7.0 network sensor that runs in a IPSO Box. I had to change the box due to a hardware problem. When I restored the old files (from another sensor couse my back-up was corrupted) It stoped sending the responses (e-mail, log DB). The only error it shows is in /var/log/messages, like this: Oct 12 18:24:37 ids4 [LOG_WARNING] ISS[23346]: (network_sensor_1) - Policy event name (NAME_OF_EVENT) could not be found in issues.csv. The policy file is newer than issues.csv I checked that issues.csv has the same size in the other sensors. Anyone has any idea? Thank�s a lot! _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
