Sophos XGS v20.0.2 - Heartbeat service dead - Decryption of passphrase is failed

I would recommend to deregister the cluster after the backup/restore and then join the cluster again to Central.

This fixed the issue. Thank you.

The heartbeat service is running with no issue now but it created a new problem. The heartbeatd.log ist getting flooded with "Cannot create ID for application, because appId range is exhausted. Application will be ignored.".

I found a different discussion with the same issue.  heartbeat log: Cannot create ID for application, because appId range is exhausted. Application will be ignored.

You recommended to turn on the automatic cleanup of the application database which we already have enabled. It shows that we only have 849 applications.

In that other discussion they mentioned a way to flush the database manually by deleting from 4 different database tables. Before I use them I wanted to ask if the commands for that are still valid?

we've had a case open for that. They can perform DB commands to flush old app entries.
for your reference: 06348145 / Firewall Heartbeat: appId range is exhausted

suggest to open a case and let them do the task

Hi, Sophos Dev here.  Do you mind sending me a private message (your settings do not allow me to initiate one with you).

I am tracking down encryption issues and very rarely find anyone with reproduction information.

If anyone else is facing this issue, the commands described in the previous mentioned discussion are still valid.

This issue should only occur if you have a firewall which was running a version prior to v20.

Commands to wipe the registered applications from the database:

psql -U pgroot -d corporate -c "DELETE FROM tbleacapplications"

psql -U pgroot -d corporate -c "DELETE FROM tbleacappcache"

psql -U pgroot -d corporate -c "DELETE FROM tblappstoeps"

psql -U pgroot -d corporate -c "DELETE FROM tbleacendpoints"

service heartbeat:restart -ds nosync

Keep in mind that this will affect your live heartbeat authenticated users.

For reference our case id was 02029324.

today I see this on our firewall again

[2024-12-17 07:41:34.286Z] INFO SacProcessor.cpp[19872]:64 discardApp - Sent switchOffConnectionInfo request to endpoint: <3d9917c9-309c-4832-b2f9-22449f9897b5>, Application path :C:\134program files\134mozilla firefox\134firefox.exe
[2024-12-17 07:41:34.521Z] ERROR SacProcessor.cpp[19872]:100 handleApp - Cannot create ID for application, because appId range is exhausted. Application will be ignored.
[2024-12-17 07:41:34.911Z] ERROR SacProcessor.cpp[19872]:100 handleApp - Cannot create ID for application, because appId range is exhausted. Application will be ignored.

I wouldn't expect this to happen at this No# of apps: 6353

You can check the database with the following command.

psql -U pgroot -d corporate -c "SELECT count(*) FROM tbleacapplications"

It should print you the same number as the GUI. My guess, it will show you more then 10000 resulting in that error message. If it shows more then 10000, the only solution I'm aware of is the manual cleanup of the database with the commands provided by support.

yes, 15003

Strange, it counts only 6300 on GUI.

have that case created 02121314 

Yeah that was the same for when we had the issue. We had 15002 applications in the database. If I see your number now, I would guess the limit is 15000 and not 10000.

What SFOS version are you on?