This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Delay in Central Management Alerts since 04/20/2024

FFin 7 months ago

Are there any known issues with central management communication currently?

Starting on 04/20/2024 i'm getting central-alerts with massive delay of 3-9 hours. (SFOS Home, V20.0GA)
I've an fixed PPPoE reconnect every morning at 3 a.m., so i expect an alert every day at this time.

(By the way... Feature-Request to suppress alert when using scheduled reconnect?:)

Since saturday central is reporting this with increasing delay of multiple hours:

As i have 2 WAN connections online, there's no real interruption to central management/reporting communication.
Any idea why there is this delay?

Connecting to webadmin using central management is totally fine all the time.
Internet-Access as well.

centralmanagement.log

2024-04-22 11:12:31Z INFO central-connect[23375]:221 main:: - Polling for SSO to PIC-URI [https://utm-cloudstation-eu-central-1.prod.hydra.sophos.com]/sophos/api/v1/firewalls/C01001XXXXXXXXX/sshTunnel  Timezone: Europe/Berlin
2024-04-22 11:12:32Z INFO central-connect[23375]:276 main:: -  got response of poll for SSO. Status: disconnected backupExpected:
2024-04-22 11:13:07Z INFO central-connect[23530]:221 main:: - Polling for SSO to PIC-URI [https://utm-cloudstation-eu-central-1.prod.hydra.sophos.com]/sophos/api/v1/firewalls/C01001XXXXXXXXX/sshTunnel  Timezone: Europe/Berlin
2024-04-22 11:13:07Z INFO central-connect[23530]:276 main:: -  got response of poll for SSO. Status: disconnected backupExpected:
2024-04-22 11:13:42Z INFO central-connect[23654]:221 main:: - Polling for SSO to PIC-URI [https://utm-cloudstation-eu-central-1.prod.hydra.sophos.com]/sophos/api/v1/firewalls/C01001XXXXXXXXX/sshTunnel  Timezone: Europe/Berlin
2024-04-22 11:13:42Z INFO central-connect[23654]:276 main:: -  got response of poll for SSO. Status: disconnected backupExpected:

This thread was automatically locked due to age.

Top Replies

LuCar Toni 7 months ago +1

I can, as far as i can see, reproduce this issue. Stay tuned.

Parents

0 Vivek Jagad 7 months ago

Hi FFin ,

Thank you for reaching out to the community, as of now no such issue, you can check the status here - https://status.sophos.com/

For schedule reconnect, I'd recommend you reach out to your Account Manager, Sales Engineer, or Sales Representative so that they can enter this request into our system. You can also log a support case so that our support representative can help raise and link it to your account.

Additionally, you can use the in-product feedback in the Sophos Firewall located in the Top Menu Bar.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 FFin 7 months ago in reply to Vivek Jagad

Thanks Vivek Jagad , but how to solve alert-delay in central? ;)
Any logs i can check within my sfos appliance? - looks like an central issue for me.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad 7 months ago in reply to FFin

are you able to resolve the url from the cli of sophos - utm-cloudstation-eu-central-1.prod.hydra.sophos.com
#nslookup utm-cloudstation-eu-central-1.prod.hydra.sophos.com ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 FFin 7 months ago in reply to Vivek Jagad

Yes, no problem:

Accessing webadmin using central is possible as well.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad 7 months ago in reply to FFin

So your issue is that the access is just slow from the central and not any other issue like not accessible at all right ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 FFin 7 months ago in reply to Vivek Jagad

My issue is, that e.g. "Gateway down" (& up again) alerts in sophos central no longer appear in the moment the problem occurs.
Alert "gateway down" 6-9 hours later does not help!

Failure occurs 3 a.m. and alert is being send e.g. 1p.m. (see screenshots above)
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad 7 months ago in reply to FFin

Under Administration > Notification settings > what is your Mail server settings configured to ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 FFin 7 months ago in reply to Vivek Jagad

I'm talking about sophos central alerts and mail notification - not local sfos notifications.
Central shows:

But recent "real" timestamps were all 3 a.m. - like all days before and i can see in sfos webadmin:
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 FFin 7 months ago in reply to Vivek Jagad

I'm talking about sophos central alerts and mail notification - not local sfos notifications.
Central shows:

But recent "real" timestamps were all 3 a.m. - like all days before and i can see in sfos webadmin:
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Vivek Jagad 7 months ago in reply to FFin

Can you please share the Sophos-central.log & centralmanagement.log ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 FFin 7 months ago in reply to Vivek Jagad

Nothing unusual, i guess:

But as LuCar could reproduce this interally we might wait for the results!
Cancel
Vote Up 0 Vote Down

Cancel