DO NOT INSTALL 9.703-2!!!
My lab system was Up2Dated to 9.703-2 Thursday evening at 10PM CDT (UTC -0500) and all connection with the outside world immediately stopped. My local connection would work normally a few minutes at a time and then everything would lock up for a few minutes. I could not identify the problem with top, but did see a lot of zombie confd processes. I lost the entire day of Friday because my wife has a big project due next week and was working via Microsoft Teams all day with her colleagues.
I will suggest to Sophos that the file be removed from the ftp site. Grumble.
Cheers - Bob
Hmmm Sophos is still rolling this update to the firewalls, just got mails from several UTM's that the fw is ready for install....
Best regards Martin ;-)
Sophos UTM Certified Engineer v9.7Sophos XG Certified Architect v18.5Homelab: 1 x XGS2100 SFOS v18.5 - 3xAPX530 - 1 x SG210 v9.7 - 1 x UTM 220 v9.7 - 1 x SG135 v9.7 (All Fullguard Plus licenses)
Today, I can report ugly behaviour from 9.703 UTMs, high CPU usage (before during normal activities 7-15%, now always up to 55% with our SG210.
Sluggish internet access, sometimes minutes with no DNS / Web like something is "stuck"
Mit freundlichem Gruß, Regards from Germany,
New Vision GmbH, GermanySophos Silver-Partner
If a post solves your question please use the 'Verify Answer' button.
What about system-log and fallback-logs?! ;)
You mean me looking at that?
I have upgraded the devices i have in my lab, no issues at all, but I can see that others are seeing the same, I just wonder what could be wrong.
Often the system log and fallback logs are good places.
Coud you post how they look maybe?
Think many people hear are curious on what the h... is wrong with the update.
Here they are, these are from the SG210 that jumped to unusual 55% percent CPU usage, while being in lox 7%-15% range normally.I see strange ntpd things, why is this creating interfaces all the day?
Definately something going on with your interfaces, mine does not have all theese:
2020:04:16-00:15:29 fw ntpd: Listen normally on 69 eth3 xxx.xxx.xxx.xxx:1232020:04:16-00:15:29 fw ntpd: Deleting interface #68 eth3, xxx.xxx.xxx.xxx#123, interface stats: received=0, sent=0, dropped=0, active_time=32 secs2020:04:16-00:15:29 fw ntpd: new interface(s) found: waking up resolver
What does Self monitoring show?
Selfmonitoring as of today (complete log)
2020:04:16-10:34:39 fw selfmonng: I check Failed increment afc_running counter 1 - 32020:04:16-14:24:35 fw selfmonng: T Global skip state now 'ON'2020:04:16-14:26:15 fw selfmonng: T Selfmonitor Daemon successfully started2020:04:16-14:26:15 fw selfmonng: T Loading Selfmonitoring Checks complete new=93 failed=0 retained=0 dropped=02020:04:16-14:26:30 fw selfmonng: I check Failed increment dnsresolver_running counter 1 - 32020:04:16-14:26:45 fw selfmonng: T read config file '/etc/selfmonng.conf'2020:04:16-14:26:45 fw selfmonng: I check Failed increment service_monitor_running counter 1 - 32020:04:16-14:26:50 fw selfmonng: I check Failed increment pluto_running counter 1 - 152020:04:16-14:26:50 fw selfmonng: I check Failed increment starter_running counter 1 - 3
The 198.19.250.x/24 network range is linked to HA, are you using HA? if not try disable this. By default I think it is set to zeroconf. If you could post the high availability logs it may have more details there
2020:04:16-00:00:27 fw ntpd: Listen normally on 41 eth3 198.19.250.x:1232020:04:16-00:00:27 fw ntpd: Deleting interface #40 eth3, 198.19.250.x#123, interface stats: received=0, sent=0, dropped=0, active_time=64 secs2020:04:16-00:00:27 fw ntpd: new interface(s) found: waking up resolver
if you cannot get to the web admin but have serial/shell access as root you can run this command to check the status and disable
cc get ha status
cc set ha status off
I know, but neither is there something configured for HA, nor is something connected to port eth3.
HA was set to "automatic", I turned to "OFF" now and watch what happens.
Installed 9.703-3 overnight ... and now Office 365/AD will not Sync and no-one can use Single Sign on to any of the Enterprise Apps installed with Office 365ANyone else having this issue?!?!
I would advise you to open a support case and PM me the case number for further investigation.
Community Support Engineer | Sophos Technical SupportSupport Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts If a post solves your question use the 'Verify Answer' button.