Sophos XGS v20.0.2 - Heartbeat service dead - Decryption of passphrase is failed

I would recommend to deregister the cluster after the backup/restore and then join the cluster again to Central.

The heartbeat service is running with no issue now but it created a new problem. The heartbeatd.log ist getting flooded with "Cannot create ID for application, because appId range is exhausted. Application will be ignored.".

I found a different discussion with the same issue.  heartbeat log: Cannot create ID for application, because appId range is exhausted. Application will be ignored.

You recommended to turn on the automatic cleanup of the application database which we already have enabled. It shows that we only have 849 applications.

In that other discussion they mentioned a way to flush the database manually by deleting from 4 different database tables. Before I use them I wanted to ask if the commands for that are still valid?

If anyone else is facing this issue, the commands described in the previous mentioned discussion are still valid.

This issue should only occur if you have a firewall which was running a version prior to v20.

Commands to wipe the registered applications from the database:

psql -U pgroot -d corporate -c "DELETE FROM tbleacapplications"

psql -U pgroot -d corporate -c "DELETE FROM tbleacappcache"

psql -U pgroot -d corporate -c "DELETE FROM tblappstoeps"

psql -U pgroot -d corporate -c "DELETE FROM tbleacendpoints"

service heartbeat:restart -ds nosync

Keep in mind that this will affect your live heartbeat authenticated users.

For reference our case id was 02029324.

today I see this on our firewall again

[2024-12-17 07:41:34.286Z] INFO SacProcessor.cpp[19872]:64 discardApp - Sent switchOffConnectionInfo request to endpoint: <3d9917c9-309c-4832-b2f9-22449f9897b5>, Application path :C:\134program files\134mozilla firefox\134firefox.exe
[2024-12-17 07:41:34.521Z] ERROR SacProcessor.cpp[19872]:100 handleApp - Cannot create ID for application, because appId range is exhausted. Application will be ignored.
[2024-12-17 07:41:34.911Z] ERROR SacProcessor.cpp[19872]:100 handleApp - Cannot create ID for application, because appId range is exhausted. Application will be ignored.

I wouldn't expect this to happen at this No# of apps: 6353

You can check the database with the following command.

psql -U pgroot -d corporate -c "SELECT count(*) FROM tbleacapplications"

It should print you the same number as the GUI. My guess, it will show you more then 10000 resulting in that error message. If it shows more then 10000, the only solution I'm aware of is the manual cleanup of the database with the commands provided by support.

yes, 15003

Strange, it counts only 6300 on GUI.

have that case created 02121314 

Yeah that was the same for when we had the issue. We had 15002 applications in the database. If I see your number now, I would guess the limit is 15000 and not 10000.

What SFOS version are you on?

v21.0

According to the other discussion it should have been fixed in v20. So either the fix was not implemented or the fix is not working as intended.

I will monitor our log and check the app count in a few weeks after the cleanup has cleaned up a few applications.

Would love to hear any new information you get from your case if you don't mind.

sure, I'll report the outcome here.

it's bad, that this problem just happens and nobody will take notice unless you catch it by chance in the text log of heartbeatd.

probably a huge part of the learned apps is again temporary setup.exe files:

That should be excluded from the code or handled in a better approach. Large environments have thousands of these occurrences.

Can this be excluded on Endpoint side so it will not sync the application c:\windows\temp\*\setup.exe to Central?

We would need access to the device to investigate properly. So I request you to create a case with Sophos support. 

We would need access to the device to investigate properly. So I request you to create a case with Sophos support. 

sure. case is already open. case# is 02121314