STAS random disconnects live users - FW webfilter is blocking then

Hello,

You might wants to review below KBA:

community.sophos.com/.../sophos-firewall-best-practice-for-stas

Thanks for your answer.
I know this KBA but we didn't change anything tho, so that makes me wonder why this is happening.

Do you know what logon type 3 stays for?

Hello,

I understands that there is no change. But we still have to review the logs as per te troubleshooting steps added in KBA.

For logon type, refer below:

support.sophos.com/.../KBA-000006347

Thank you for your quick reponse.

Sure understand, do you know if I can see besides the stas logs on the agent itself is there a way to check the log of the firewall to understand why it might disconnect there from the live users list?

Also if logon type 3 means not DC server rather than a member server which is odd to me cause we only use the STAS agents on both of our DC Servers.

Hello,

Yes, you can review access_server.log file from advance shell. Add services in debug using below

#service access_server:debug -ds nosync   (use the same command to disable)

#tail -f /log/access_server.log

Also, kindly review the KBA for the recommended configuration when we have multiple AD.

Thanks, I will collect some data and try to analyze/identify the root cause of the problem.
Do you know why logon type 3 takes in place tho?

What do you mean with multiple AD? Do you mean multiple Domain Controller?

Hello,

Yeah I mean Domain Controller!

For logon type 3 as well, we need to investigate. You may review the stas.log file on DC.

I created a case for it last friday.

Case ID:
01852568

I provided a lot of logs. I keep this thread updated about the result / solution.

Hello,

Thank you for sharing us the case ID.