Sophos XG Firewall 17.5: Logs are not updating on the GUI "Log Viewer"

Sophos XG firewall is offering on Device Reporting and logs, which is a good feature for all SMBs. There is another module "Sophos iView" available for logs and reporting but it is good for some critical organization or big data Center who need a lot of logs, reports, and backup of all those.   

Recently, I faced an issue as there is no log showing on the GUI "Log Viewer" but you will see all logs through the command line or some new logs on the auxiliary device but not on the primary devices (new logs not updating). This issue is reported on a virtual and hardware firewall as well. Today I am going to share how to handle this issue without book a ticket with the NOC team.


Issue Reported:

Logs are not updating on the GUI "Log Viewer" application of the Sophos XG firewall. 

Troubleshooting Steps:

Please read a full blog post at:

  • In reply to EmileBelcourt:


    @Emile Have responded to PM


    @Buck Have 15 which I manage, most are running 17.5.4 MR4 at present and will be staying there until this is resolved. Have had no Gartner logging issues with any of them, but most of them do not produce a large volume of logs per day. All are a minimum of an XG125, with a couple of XG210 and a XG310


    I only upgraded 2 units to MR6 due to the listed IPSec fixes related to connection rekey issues believing it may assist with the Azure issue. But without logging it is really difficult to resolve.

    There needs to be a way of getting the console logs out, but I cant seem to find one.