Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 37 subscribers
  • Views 1626 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

networkd.log file questions

MarkThornton

Where can I find a description of the messages I find in the networkd.log? I'm looking for how to tell what might be going wrong with the wan dhcp request on my port2 on one of my XGS107's that is unable to renew an ip address.

Can I disable the GuestAP interface so that it doesn't throw messages into the networkd.log?

It would be helpful if the udhcpc entries had a timestamp on them. I have to count how many successes I find since the last timestamp and multiply by 43200 seconds (12 hours) to get an assumed amount of time that has passed between each success.

udhcpc: sending renew to 100.79.79.220
udhcpc: sending renew to 0.0.0.0
udhcpc: lease of 100.79.79.219 obtained, lease time 43200
Success



This thread was automatically locked due to age.
  • 0

    The reason I am asking is one of my XGS107's stops renewing the wan dhcp address after 12 or so hours. I lose wan connection when the ip on the wan changes and the firewall has stopped renewing the ip address. I can get things working again by connecting to the XGS via the lan port and save the wan port2 connection, which apparently wakes up networkd and checks all the ports, and gets a valid ip. Problem is that requires driving to the remote site.

    So far, support is lost. They keep wanting to look at the dhcpd.log file but that isn't where the wan dhcp requests and results show up. That is for the dhcp service on the lan or other ports,

  • 0 in reply to MarkThornton

    Hello Mark,

    Thank you for contacting the Sophos Community.

    Can you confirm the Case ID is 06370178?

    What Firmware version are you using?

    What is the issue you’re facing with the DHCP on WAN? The lease expires, and the Firewall doesn't request a new one, or for example, the modem goes down, it gets a new IP, but the Sophos Firewall keeps the old IP? 

    I will pass you feedback about the time stamp.

    The logs you can check are:
    syslog.log
    dgd.log
    networkd.log 

    Regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
  • 0 in reply to emmosophos

    Yes that is the correct case number. XGS107 (SFOS 19.5.1 MR-1-Build278)

    I was losing connectivity over the wan port. I could log into the firewall from the lan port and look at the logs. I'm certainly no log guru but it appeared to me the process that writes networkd.log stopped requesting to renew the ip address. It would usually work once but fail at the second renew, 24 hours. I could recover the port by opening the wan port in Networking and saving it. For some reason I can't explain I replaced the network cable between the XGS107 and the Cradlepoint CBA850. The firewall stayed connected through the entire weekend and the logs show it was renewing the ip. I'm wondering if there was some problem with the cable that hung up the process? I'm stumped.

    I wish the udhcpc reported in networkd.log had a timestamp for debugging purposes. Now I just count the number of renews since the last timestamp and multiply by 12 hours to determine if the logs are still being written to.

    MarkThornton said:
    : sending renew to 100.79.79.220
    u
  • 0 in reply to MarkThornton

    Hello Mark,

    Thank you for the update!

    There’s a known limitation in the Sophos Firewall; for example, if you shut down the Modem and turn it on again, the Sophos Firewall won’t change the WAN IP because of the RFC standard; it won't request any IP.

    However, if you edit the interface, click "edit", and click save, the new IP will be assigned to the WAN.

    This behavior will change in future DHCP improvements (no ETA).

    I don't think you’re affected by this, but this is what I was after. 

    Regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
  • 0 in reply to emmosophos

    Thank you for the info on the limitation. That sounds a bit like what I was experiencing, the cable must have been dropping the connection enough to trigger something like that. The concern I have that it sounds like you are addressing is if we have a power outage and all devices get bounced, are we now in a race to get everything back up in the right order so connectivity returns when power is restored at the remote location. In our case the Cradlepoint modem seems to boot up and be ready much faster than the Sophos so hopefully that problem won’t occur unless I trip over a power cord or something.

Unfiltered HTML