logging: heartbeat vs fwcm-heartbeatd, 500 Opcode Failed

Hello LHerzog,

Thank you for contacting the Sophos Community.

The service should be registered and running, which is why I believe they’re asking you to de-register and re-register the device so the services are forced to restart.

You can check the fwcm-eventd.log for the entry fwcm-updaterd stopped or something along those lines. This will show you the time the service failed.

Could you please share your Case ID, and is this device part of HA?

Regards,

thanks for your explaination. Case is 04121743 and it's HA. I think, we're currently for months on the "other node" as when we enabled central integration.

those fwcm logs are all completely blank.

XG430_WP02_SFOS 18.0.5 MR-5-Build586# ls -li /log/fwcm-*
6815873 -rw-r--r--    1 root     0                0 Jan 15 10:17 /log/fwcm-eventd.log
6815871 -rw-r--r--    1 root     0                0 Jan 15 10:17 /log/fwcm-heartbeatd.log
6815872 -rw-r--r--    1 root     0                0 Jan 15 10:17 /log/fwcm-updaterd.log

XG430_WP02_SFOS 18.0.5 MR-5-Build586# cat /log/fwcm-*.log
XG430_WP02_SFOS 18.0.5 MR-5-Build586#

and they are blank on the other HA node as well:

XG430_WP02_SFOS 18.0.5 MR-5-Build586# ls -li/log/fwcm-*
18350209 -rw-r--r--    1 root     0                0 Jan  8 12:37 fwcm-eventd.log
18350207 -rw-r--r--    1 root     0                0 Jan  8 12:37 fwcm-heartbeatd.log
18350208 -rw-r--r--    1 root     0                0 Jan  8 12:37 fwcm-updaterd.log

turned out, the command I got from support to enable debug was just wrong. It was also wrong, when they tried to shoot this command from remote CLI. And as a result of this, I was asked to remove the Firewall from Sophos Central...

I'm sad, this matches to the overall impression I have from support.

this works:

service -t json -b '{"debug":"2"}' -ds nosync heartbeat:debug

this not:

service -t json -b ‘{“debug”:”2”}’ -ds nosync heartbeat:debug

Result is

XG430_WP02_SFOS 18.0.5 MR-5-Build586# service -t json -b '{"debug":"2"}' -ds nosync heartbeat:debug
200 OK
{ "trace": "on" }

Hello LHerzog,

Thank you for the feedback I have passed this to the Manager and the owner of the case, it seems the formatting of the symbols (') (") might have changed once the engineer copied the command to the email, however, the engineer should have double-checked before sending the command.

Regards,

Thank you emmpsophos. Maybe, but if your supporters execute those commands through the remote access tunnel, they should get it done.