I am running XG FW firmware version 19.0.0.
Log Viewer is no longer showing current entries for all categories.
The last entry logged was on 1/26/22.
I've checked log settings and disk space and everything looks correct.
I also have several firewall rules checked to 'log firewall traffic' however no traffic is being logged.
Any ideas where else I could look or how to resolve?
Thank you for contacting the Sophos Community.
Adding to rfcat suggestion, check if the garner and reportdb services are running: (You need to SSH in to the XG and press 5>3 to land in the advanced shell)
# service -S | grep garner# service -S | grep report# csc custom status (you should look for Busy Workers)
If you notice either the garner or report services stopped or not running, try starting or restanting it
# service garner:restart -ds nosync
# service reportdb
Check for any error in the:
I've restarted and when I checked services of garner and reportdb, both were running.
I did find the following in the garner, reportdb and postgres log files. It appears to be some sort of corruption? Do either of you know what the tail of these logs are pointing to? The postgres log hasn't been updated since May:
tail garner.logSFEVENTSFTS: Jun 13 19:29:08Z:execute_sqlite_prepared_stmt: stmt execution failed: database disk image is malformedSFEVENTSFTS: Jun 13 19:29:08Z:execute_sqlite_prepared_stmt: stmt execution failed: cannot commit - no transaction is activeSFEVENTSFTS: Jun 13 19:29:08Z:end_transaction: Transaction Couldn't COMMIT;SFEVENTSFTS: Jun 13 19:29:08Z:sqllite_db_fini: Transaction End FailedSFEVENTSFTS: Jun 13 19:29:08Z:end_transaction: Transaction Couldn't COMMIT;SFEVENTSFTS: Jun 13 19:29:08Z:reset_transaction: end Transaction FailedSFEVENTSFTS: Jun 13 19:29:08Z:sqlite_db_insert_data: reset transaction failed for table 'tbllog'SFEVENTSFTS: Jun 13 19:29:08Z:sfeventsfts_insert_data: insert failed with SQLITE_GENERAL_ERRORSFEVENTSFTS: Jun 13 19:29:08Z:sfeventsfts_insert_data failedtail reportdb.log10459 2022-06-13 19:28:13.395 GMTLOG: unexpected EOF on client connection with an open transaction21784 2022-06-13 19:28:13.395 GMTLOG: unexpected EOF on client connection with an open transaction20225 2022-06-13 19:28:13.396 GMTLOG: unexpected EOF on client connection with an open transaction21770 2022-06-13 19:28:13.397 GMTLOG: unexpected EOF on client connection with an open transaction21768 2022-06-13 19:28:13.398 GMTLOG: unexpected EOF on client connection with an open transaction22666 2022-06-13 19:28:13.398 GMTLOG: could not receive data from client: Connection reset by peertail postgres.log5347 2022-05-28 03:52:48.130 GMTLOG: shutting down5347 2022-05-28 03:52:48.838 GMTLOG: database system is shut down5357 2022-05-28 03:55:32.593 GMTLOG: database system was shut down at 2022-05-28 03:55:16 GMT5353 2022-05-28 03:55:32.914 GMTLOG: database system is ready to accept connections5361 2022-05-28 03:55:32.915 GMTLOG: autovacuum launcher started5438 2022-05-28 03:56:56.021 GMTERROR: null value in column "value" violates not-null constraint5438 2022-05-28 03:56:56.021 GMTDETAIL: Failing row contains (config cpulist, null, ips, ips.conf).5438 2022-05-28 03:56:56.021 GMTSTATEMENT: with upsert as (UPDATE tblconfiguration set value=(SELECT servicevalue from tblclientservices where servicekey = 'ips_cpulist') where module = 'ips' and key='config cpulist' returning *) INSERT into tblconfiguration (key,value,module,filename) SELECT 'config cpulist', servicevalue, 'ips', 'ips.conf' from tblclientservices where servicekey = 'ips_cpulist' and (SELECT count(*) from tblconfiguration where module = 'ips' and key='config cpulist') = 05438 2022-05-28 03:56:56.157 GMTERROR: current transaction is aborted, commands ignored until end of transaction block5438 2022-05-28 03:56:56.157 GMTSTATEMENT: SELECT txid_current()
I am looking for some help on this one.
Anyone know what the logs from my last post are indicating?
I haven't received any Log Viewer data for some time now.
A quick look at the logs information would imply a faulty disk and maybe the time on the XG is not updating correctly.
XG115W - v19 GA - Home
1225v5 6gb ram, SSID, 4 NICs 20w - v19 EAP - on holiday.
If a post solves your question please use the 'Verify Answer' button.
The logs indicated that your DB is corrupted, which is the cause for which your Log Viewer is not updating.
Do you see any core dump under ls -la /var/cores/
You could take a backup of your current configuration and re-image your device, if the issue re-appears most likely your HDD might have started to fail in which case you might need to RMA the device if it is still under warranty.
Thanks for the response.
There is only one core.awed file from 2020 so I don't think it is related since the logs stopped at the beginning of this year.
This is running on a VM so I will create a back up and spin up another VM, then perform a restore.
However, before I do that are there any specific commands I can run, besides the standard linux ones that would assist in determining if this is a disk problem? Also, can I rebuild or replace the database?
I ran fdisk and badblocks and there were no errors / bad sectors
Hey BlackSheepOneTo check the status of Sophos Firewall's reporting, follow the steps below.
Use the following command from the CLI to check the disk size usage by reports.
system diagnostics show disk
Thanks & Regards,
Vivek Jagad | Technical Account Manager 3 | Cyber Security EvolvedSophos Community | Product Documentation | Sophos Techvids | SMSIf a post solves your question please use the 'Verify Answer' button.
Looks good there also:
console> system diagnostics show diskPartition Utilization(%)===============================configuration 19%content 11%report 32%
Can you check the data retention period once here: https://support.sophos.com/support/s/article/KB-000035780?language=en_USAnd under the system services > Log settings - what all the options enabled ?==========Under the Administration > time > is it set to "Use pre-defined NTP server" or "Do not use NTP server?"