Log Viewer not Updating

Question

Hello, 
 I am running XG FW firmware version 19.0.0. 
 
 Log Viewer is no longer showing current entries for all categories. 
 
 The last entry logged was on 1/26/22. 
 I've checked log settings and disk space and everything looks correct. 
 I also have several firewall rules checked to 'log firewall traffic' however no traffic is being logged. 
 Any ideas where else I could look or how to resolve?

Vivek Jagad · Accepted Answer

Hey BlackSheepOne , As emmosophos confirmed based on the logs, it looks like DB corruption. It's best to contact support and support can help either with re-buidling the database OR you can re-image the appliance and t hen restore the backup: https://support.sophos.com/support/s/article/KB-000036812?language=en_US

BlackSheepOne · Answer

All, 
 Thanks for the help. 
 I downloaded the latest VM image, spun it up and restored the latest backup, which was quick and easy. 
 Logs are working again. 
 This by far was an easier fix and total downtime between switching VMs was about 20 seconds! 
 Kerry

emmosophos · Answer

Hello there, 
 Thank you for contacting the Sophos Community. 
 Adding to rfcat suggestion, check if the garner and reportdb services are running: (You need to SSH in to the XG and press 5>3 to land in the advanced shell) 
 # service -S | grep garner # service -S | grep report # csc custom status (you should look for Busy Workers) 
 If you notice either the garner or report services stopped or not running, try starting or restanting it 
 # service garner:restart -ds nosync 
 # service reportdb 
 Check for any error in the: 
 
 garner.log 
 reportdb.log 
 postgres.log 
 
 Regards,

emmosophos · Answer

Hello there, 
 The logs indicated that your DB is corrupted, which is the cause for which your Log Viewer is not updating. 
 Do you see any core dump under ls -la /var/cores/ 
 You could take a backup of your current configuration and re-image your device, if the issue re-appears most likely your HDD might have started to fail in which case you might need to RMA the device if it is still under warranty. 
 Regards,

Log Viewer not Updating

Top Replies