Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

ips.log filling up disk

We have XG210 with SFOS 19.5.4. I've noticed ips.log filling up /var partition till there is no free space on disk and it causes device to boot into fail-safe mode. Stopping IPS service stops log file from growing but when I restart IPS service, this issue occurs again. Switching off IPS Protection button from Intrusion Prevention menu or removing IPS polices from all firewall rules does not resolve this issue and only stopping service stops it. Here is the log that reappears again and again in the log file and causes this issue:

2024-03-03T20:42:03.268400Z [28142]:DAQ:INFO:daq_nmsp.c:2342(daq_nmsp_get_pkt)--> jumbogram read failed. jumbo len: 0 rslot 11 rlen 2048

2024-03-03T20:42:03.268402Z [28142]:DAQ:INFO:daq_nmsp.c:2384(daq_nmsp_get_pkt)--> Exit --> DAQ Error -7

I've tried re-imaging SFOS but it didn't solve the problem. Is there anyway to solve this issue without need to stopping IPS?

Added TAGs
[edited by: Erick Jan at 10:48 AM (GMT -8) on 4 Mar 2024]
Parents Reply
  • In my oppinion it's not a problem with log rotation. Furthermore it's a problem in the ips /dpi engine.

    As soon as the error occurs the firewall is becoming more and more unstable until all connections are dropped and during this time there are thousands of the messages you mentioned above in the ips.log.

    The ips.log is growing then from 300MB to about 170gb which fills the partition up. All of this happens in just a few minutes.

    The only thing we can do about this is failover to the auxilliary node and clean up the partition on the former primary node.

    We are running into this issue approx. every 2 weeks.

    The cluster is running on SFOS V20.