Problem with many User on V18

Hi TimFranken,

Apologies for the inconvenience caused. Were you able to collect client logs from the SSL VPN client and sslvpn logs from the XG running with V18? If yes, please share logs.

Thanks,

Unfortunately I was not able to save and evaluate logs. I was under a lot of pressure today, so that people can get back to work properly as soon as possible. They were all sitting at home and could not work. So I decided to boot the 17.5 again relatively quickly.

On top of that I was just sitting at home and my remote session was also disconnected. Could only wait until the firewall was back after 3-4 minutes and I could connect again. After the whole thing happened 3-4 times, I booted the 17.5 again and it is running stable since then.

Is there a way to get the logs in the inactive image now?

So i boot the V18 again and in LogViewer i can't find anything.

I connected to ssh and found this in syslog

Hi,

I have the same problem. Sophos Support told me there is problem with the hardware. This was the reason he thinks it is the hardware.

XG310_WP02_SFOS 18.0.0 GA-Build339# tail -f syslog.log
Mar 18 13:22:49 (none) local0.err [ctipd][5002]: CEnginesContainer::GetCacheDelta - HttpError: 400

I dont think it is a hardware error tho, since we have a HA setup and the issue is with both firewalls.

He told me to try and reimage the firewall

Article ID: 126906
Title: Sophos XG Firewall: How to re-image the appliance
URL: https://sophos.com/kb/126906

I will try to go back to V17 for now and see how it goes.

Hello all,

this is not a problem with HW appliance, our customer has vmware virtual appliance (SFV4C6) and has absolutely identical problems!!!

Regards

alda

smae problem here with an XG310 even the log looks the same

Reverting worked for us so far. 30 Users connected at the moment with no problem.

We run SFV4C6 on VMware 6.5. Upgrade from SFOS 17.5.9 MR-10 to SFOS 18.0.0 GA-Build339 on Saturday. First sudden restart on Monday morning, six times yesterday and ten times today. It looks like some kernel panic problem if the number of SSLVPN connections exceeds 15.

The dots only in /log/syslog.log before "syslog.info syslogd started: BusyBox v1.21.1" messages. Sometimes "vcpu-0| I125+ The CPU has been disabled by the guest operating system. Power off or reset the virtual machine." messages in vmware.log on ESXi host.

Regards

TL

TomasLavicky 

can you share logs with ?

This issue is serious specially now that the world is relying on VPN and must be treated soon.

Please let us know.

Thanks

Nothing interesting in /log/syslog.log around reset:

Mar 18 10:34:48 (none) user.err kernel: [  400.788292] 215:appfiltermap_adt_parser:policy 7 max app order  
2 max eac apporder 0
Mar 18 10:34:48 (none) user.err kernel: [  400.788296] 711:appdev_write:count 2011
Mar 18 10:34:48 (none) user.err kernel: [  400.788299] 758:appdev_release:dev open 3
Mar 18 10:34:48 (none) user.err kernel: [  400.788300] 771:appdev_release:counter 7 size 128
Mar 18 10:34:48 (none) user.err kernel: [  400.788301] 774:appdev_release:dev open 0
..........................................................................................................
....................................Mar 18 10:35:48 (none) syslog.info syslogd started: BusyBox v1.21.1
Mar 18 10:35:48 (none) user.notice kernel: klogd started: BusyBox v1.21.1 (2020-03-04 19:44:36 CET)
Mar 18 10:35:48 (none) user.notice kernel: [    0.000000] Linux version 4.14.38 (jenkins@ci-1) (gcc versio
n 7.3.0 (OpenWrt GCC 7.3.0 7185-ged7f3dd9)) #2 SMP Wed Mar 4 22:26:05 CET 2020
Mar 18 10:35:48 (none) user.info kernel: [    0.000000] Command line: BOOT_IMAGE=/18_0_0_339 quiet console
=tty0 console=ttyS0,38400n8

/log/sslvpn.log rounds in few minutes. I have none in time of reset.

SFV4C6_VM01_SFOS 18.0.0 GA-Build339# ll /log/sslvpn*
-rw-r--r--    1 root     0         51282011 Mar 18 17:25 /log/sslvpn.log
-rw-------    1 root     0         67640645 Mar 18 17:20 /log/sslvpn.log.0

We're trying to move to L2TP or we will downgrade to SFOS 17.5.9 MR-10.