I need a solution
After I added a IPv6 IP in lookup table, many exception error occurred in rule processing (CPU usage up to 100%).
Then, I deleted the IPv6 record and restart SSIM. SSIM became normal again. Any suggestions or solutions?
SSIM version: 4.8.1 Patch 1
2013-09-06 14:04:21,848 [RuleProcessor] ERROR com.symantec.sim.cm.svc.CorrelationManager - Exception occurred while processing rule :
java.lang.IllegalArgumentException
at com.symantec.sim.util.IPMask.validateMaskedBits(IPMask.java:172)
at com.symantec.sim.util.IPMask.getMaskedBits(IPMask.java:154)
at com.symantec.sim.util.IPMask.setMaskedBits(IPMask.java:134)
at com.symantec.sim.util.IPMask.<init>(IPMask.java:66)
at com.symantec.sim.tables.BasicLookupTable.contains(BasicLookupTable.java:857)
at com.symantec.sim.cm.plugins.Rule.tableContains(Rule.java:309)
at com.symantec.sim.cm.plugins.弱點掃描_.弱點掃描_.filterEvent(弱點掃描_.java:36)
at com.symantec.sim.cm.svc.CorrelationManager$RuleProcessorTask.run(CorrelationManager.java:1131)
raw_event = 2013-09-06 14:04:21,848 [RuleProcessor] ERROR com.symantec.sim.cm.svc.CorrelationManager - Exception occurred while processing rule :
java.lang.IllegalArgumentException
at com.symantec.sim.util.IPMask.validateMaskedBits(IPMask.java:172)
at com.symantec.sim.util.IPMask.getMaskedBits(IPMask.java:154)
at com.symantec.sim.util.IPMask.setMaskedBits(IPMask.java:134)
at com.symantec.sim.util.IPMask.<init>(IPMask.java:66)
at com.symantec.sim.tables.BasicLookupTable.contains(BasicLookupTable.java:857)
at com.symantec.sim.cm.plugins.Rule.tableContains(Rule.java:309)
at com.symantec.sim.cm.plugins.弱點掃描_.弱點掃描_.filterEvent(弱點掃描_.java:36)
at com.symantec.sim.cm.svc.CorrelationManager$RuleProcessorTask.run(CorrelationManager.java:1131)