WAF: Warning: DocumentRoot [/sdisk/waffiles/########] does not exist

Question

Sophos FW v19.0.1 (Build 365) - With a Home LIcence Since upgrading to this version, I have had to WAF functionality, and there are no errors being shown in WebAdmin 
 Going into the shell and looking at /logreverseproxy.log I can see the following: 
 
 [ Thu Feb 02 13:57:50.892665 2023] [mpm_worker:notice] [pid 30195:tid 140254384852672] AH00295: caught SIGTERM, shutting down AH00112: Warning: DocumentRoot [/sdisk/waffiles/c1f1e4e6ef94ac8bd4b23cf2e423dce9] does not exist [Thu Feb 02 13:57:52.099469 2023] [security2:notice] [pid 31313:tid 140423597891264] ModSecurity for Apache/2.9.3 ( http://www.modsecurity.org/) configured. [Thu Feb 02 13:57:52.099489 2023] [security2:notice] [pid 31313:tid 140423597891264] ModSecurity: APR compiled version="1.7.0"; loaded version="1.7.0" [Thu Feb 02 13:57:52.099494 2023] [security2:notice] [pid 31313:tid 140423597891264] ModSecurity: PCRE compiled version="8.43 "; loaded version="8.43 2019-02-23" [Thu Feb 02 13:57:52.099499 2023] [security2:notice] [pid 31313:tid 140423597891264] ModSecurity: LIBXML compiled version="2.9.9" [Thu Feb 02 13:57:52.099503 2023] [security2:notice] [pid 31313:tid 140423597891264] ModSecurity: ma engine is currently disabled, enable it by set SecStatusEngine to On. [Thu Feb 02 13:57:52.185033 2023] [mpm_worker:notice] [pid 31315:tid 140423597891264] AH00292: Apache/2.4.53 (Unix) OpenSSL/1.1.1n configured -- resuming normal operations [Thu Feb 02 13:57:52.185062 2023] [core:notice] [pid 31315:tid 140423597891264] AH00094: Command line: '/usr/apache/bin/httpd -E /log/reverseproxy.log 
 
 If I browse /sdisk/waffiles - it is empty. I have even tried to manually create the directory shown in the logs, but as soon as the WAF is restarted after an update, all subfolders are again deleted 
 I'm preparing to revert back to 18.5 to see if this resolves the issue I had tried to upgrade to 19.5, but it froze so had to revert after 1 hour. 
 Are there any known changes in v19 that would account for this behaviour, and if so has it been fixed with v19.5 ?

emmosophos · Answer

Hello Gatt, 
 Thank you for the info. 
 That doesn't look very good; you might have a corrupted database, causing issues with some database keys. 
 I would recommend to: 
 1. Take a backup of your configuration 
 2. Spin a new VM, (don't delete the current VM); use the Backup you took on step 1 and see if the issue persists with the WAF 
 3. If the issue persists for testing only, try disabling URL Hardening, cooking, signing in one of the WAF protection policies 
 Reach out to me via DM if the issue persists and share the Access ID to your device.

Gatt · Answer

Finally, got this working After speaking with Sophos, the "DocumentRoot" error is expected behaviour - so was a red herring, however my installation was corrupted which needed a reinstall and restore from backups 
 Initially, it looked like this had failed to resolve the issues so further investigation was undertaken.. Needless to say, this lead to a lot of hair pulling as I couldn't figure out what was going on, 
 Turns out it was a weird combination of issues: My ISP had decided to update my router config, resulting in the DMZ IP I was using (the External Port for SFOS) was no longer a valid IP - this took a long time to diagnose as it didn't indicate that there was any problem with it - until I disabled it to try port forwarding. 
 When I went to re-enable the DMZ again the IP was rejected.. After a few failed attempts a new IP was finally found that it would accept. Once I updated the External IP in Sophos to be the same - It started working - kind of 
 The next issue initially looked like an SSL issue, but turned to be a set of old DNAT rules that were still present but were now causing issues with redirecting Web requests to another sever. External access now appears to be working, but keeping an eye on it for now

WAF: Warning: DocumentRoot [/sdisk/waffiles/########] does not exist

Top Replies