This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[INFO-114] Ulogd not running - restarted

Since upgrading our 2-node HA (ASG220) cluster to 9.205-12, I'm getting this error message exactly twice per day. Once in the morning sometime between 6:45-7am and again 12 hours later, around 7pm. In the warning email that's sent, CPU usage is through the roof:

-- 

HA Status          : CLUSTER MASTER (node id: 1)

System Uptime      : 21 days 15 hours 17 minutes

System Load        : 12.22

System Version     : Sophos UTM 9.205-12

After the ulogd is restarted automatically by the watchdog, CPU usage returns to normal levels. I assume some database is corrupt or something along those lines, but I don't know where to begin troubleshooting this. I see over in the (now closed) 9.205 soft-release thread, that someone else was having a very similar if not identical problem but no solution was offered. It appears that it may be related to:

fix 32238 ulogd restarts (BUG at ipfix.c:313 / BUG at thread.c:33 ) and coredumps

Can anyone please help? thanks [:)]

This thread was automatically locked due to age.

0 vilic over 9 years ago

Hmm...9.205-12 should fix that issue and not the opposite, check this thread:
https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/34493

In my experience this events are occurring randomly, reporting for a day or two (every 12h exactly, as you noticed around 7PM) and than just disappear...

System load is not the issue, CPU is idle.
Cancel
Vote Up 0 Vote Down

Cancel
0 VelvetFog over 9 years ago

The same thing is happening to me.
I keep getting the notifications several times a day.
It started after I updated the software to UTM 9.205-12.
This morning's Ulogd not running - restarted email was timestamped 6:57 AM.
Cancel
Vote Up 0 Vote Down

Cancel
0 XavierCollege over 9 years ago in reply to VelvetFog

Same this happening here - updated to 9.205-12 two weeks ago and now every 12 hours I get the "Ulogd not running - restarted" message. No issue with this type of error prior to the upgrade.

Emily
Cancel
Vote Up 0 Vote Down

Cancel
0 luckman212 over 9 years ago

I just installed 9.206-35
Will post back tomorrow if the problem is fixed.
Cancel
Vote Up 0 Vote Down

Cancel
0 luckman212 over 9 years ago in reply to luckman212

So far so good. I haven't had the ulogd crashes since installing the update. [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 thibodude over 9 years ago

Got a few similar messages ...
Http proxy not running - restarted
Snort not running - restarted
I also have the same Release 9.205-12

regards
Cancel
Vote Up 0 Vote Down

Cancel
0 thibodude over 9 years ago

luckman212, where did you get version 9.206-35 ??

My firewall tells me I have the latest firmware version... can you supply the link to download your version if stable ?
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 9 years ago

Hi, 9.206 is in pre-release stages but the up2date file is reportedly available for manual download from the Astaro FTP servers.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 9 years ago in reply to BarryG

I've seen the same thing... the problem with ulogd in some of my customers' cases started after 9.205 was installed [:)]

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 MarCow over 9 years ago

Same for me on 9.208-8 - I get at least one Ulogd restart notification per day.
Cancel
Vote Up 0 Vote Down

Cancel