Description

This article details a procedure for troubleshooting and resolving IDP security-package update issues.

Symptoms

The IDP security-package update fails with the error below when the IDP database or some files are corrupted:

Failed in opening security database

Solution

The corruption can occur because the SRX is booting up from a backup image, a power failure, or some other issue.

Does the output of the command below not show the IDP attack DB version?

> show security idp security-package-version
Error; Failed in opening security database

Does a Commit fail with the IDP configuration activated, resulting in a similar error?

Failed in opening database /var/db/idpd/db/secdb_01.db :
Invalid format or unexpected end of file

Does the security package download succeed, only to have the security package installation halt after AI installation (with the error below)?

> request security idp security-package install
Error; Failed in opening security database

Does the device show any of the above symptoms?

If the answer to this question  is "yes," the IDP DB is probably corrupted. If that is the case, perform the steps below to fix the problem:

  1. Deactivate IDP configuration, if active:

    2. # deactivate security idp
    # commit

  • From the shell prompt, navigate to the directory /var/db/idpd/db/ and list the files present there:

    • % cd /var/db/idpd/db/
    % ls -l

    This should show the files secdb_01.db , secdb_02.db , and so on.

  • Among the files listed, the IDP consults the file secdb_01.db when looking up the security-package version. Move this file to a temporary location:

    • % mv secdb_01.db /var/tmp/

  • Check the security-package-version, which should now show as N/A:

    • > show security idp security-package-version

    Attack database version: N/A(N/A)
    Detector version :12.6.160140626
    Policy template version :N/A

  • Download (full-update) and install the security-package on the device:

    • > request security idp security-package download full-update
    > request security idp security-package install

  • Confirm that the IDP includes the latest attack DB:

    • > show security idp security-package-version

  • Activate the IDP configuration, followed by a commit.

Related Information