Thread Info
  • State Not Answered
  • Replies 1 reply
  • Subscribers 4 subscribers
  • Views 635 views
  • Users 0 members are here
Options
Suggested

log error messages

Andrew English

I keep seeing this message in my system message log even though I have setup DNS correctly. Is there anyway to find out what its trying to access that is calling the DNS server failed to contact. I wonder if its trying to access to an host name that doesn't exist anymore?

I looked in Network Defs but didn't see anything that wasn't unreadable except for a few of the built-in services which I cannot edit. 

2023:09:19-11:15:01 3gmanu-fw01 /usr/sbin/cron[21406]: (root) CMD (   /usr/local/bin/reporter/system-reporter.pl)
2023:09:19-11:15:01 3gmanu-fw01 /usr/sbin/cron[21407]: (root) CMD (/sbin/audld.plx --nosys --trigger)
2023:09:19-11:15:01 3gmanu-fw01 /usr/sbin/cron[21411]: (root) CMD ( /usr/local/bin/rpmdb_backup )
2023:09:19-11:16:06 3gmanu-fw01 dns-resolver[5000]: DNS server failed to contact!
2023:09:19-11:17:01 3gmanu-fw01 /usr/sbin/cron[6628]: (root) CMD (  nice -n19 /usr/local/bin/gen_inline_reporting_data.plx)
2023:09:19-11:17:17 3gmanu-fw01 dns-resolver[5000]: DNS server failed to contact!
2023:09:19-11:18:28 3gmanu-fw01 dns-resolver[5000]: DNS server failed to contact!
2023:09:19-11:19:39 3gmanu-fw01 dns-resolver[5000]: DNS server failed to contact!
2023:09:19-11:20:01 3gmanu-fw01 /usr/sbin/cron[32760]: (root) CMD (   /usr/local/bin/reporter/system-reporter.pl)
2023:09:19-11:20:01 3gmanu-fw01 /usr/sbin/cron[32761]: (root) CMD (/var/mdw/scripts/pmx-blocklist-update)
2023:09:19-11:20:49 3gmanu-fw01 dns-resolver[5000]: DNS server failed to contact!
2023:09:19-11:22:00 3gmanu-fw01 dns-resolver[5000]: DNS server failed to contact!
2023:09:19-11:23:11 3gmanu-fw01 dns-resolver[5000]: DNS server failed to contact!
2023:09:19-11:24:21 3gmanu-fw01 dns-resolver[5000]: DNS server failed to contact!
2023:09:19-11:25:01 3gmanu-fw01 /usr/sbin/cron[14778]: (root) CMD (   /usr/local/bin/reporter/system-reporter.pl)
2023:09:19-11:25:32 3gmanu-fw01 dns-resolver[5000]: DNS server failed to contact!
2023:09:19-11:26:43 3gmanu-fw01 dns-resolver[5000]: DNS server failed to contact!
2023:09:19-11:27:53 3gmanu-fw01 dns-resolver[5000]: DNS server failed to contact!


In my fallback messages I keep seeing this:

2023:09:19-06:21:18 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Read in Accu Object from File failed
2023:09:19-06:21:18 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Write Accu Object to File failed
2023:09:19-06:26:19 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Read in Accu Object from File failed
2023:09:19-06:26:19 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Write Accu Object to File failed
2023:09:19-06:31:20 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Read in Accu Object from File failed
2023:09:19-06:31:20 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Write Accu Object to File failed
2023:09:19-06:36:21 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Read in Accu Object from File failed
2023:09:19-06:36:21 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Write Accu Object to File failed
2023:09:19-06:41:22 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Read in Accu Object from File failed
2023:09:19-06:41:22 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Write Accu Object to File failed
2023:09:19-06:46:23 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Read in Accu Object from File failed
2023:09:19-06:46:23 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Write Accu Object to File failed
2023:09:19-06:51:24 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Read in Accu Object from File failed
2023:09:19-06:51:24 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Write Accu Object to File failed
2023:09:19-06:56:25 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Read in Accu Object from File failed
2023:09:19-06:56:25 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Write Accu Object to File failed
2023:09:19-07:01:26 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Read in Accu Object from File failed
2023:09:19-07:01:26 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Write Accu Object to File failed
2023:09:19-07:06:27 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Read in Accu Object from File failed
2023:09:19-07:06:27 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Write Accu Object to File failed
2023:09:19-07:11:28 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Read in Accu Object from File failed
2023:09:19-07:11:28 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Write Accu Object to File failed
2023:09:19-07:16:29 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Read in Accu Object from File failed
2023:09:19-07:16:29 3gmanu-fw01 [local7:err] waf-reporter[8535]:  Write Accu Object to File failed
2023:09:19-07:17:14 3gmanu-fw01 [daemon:debug] rrdcached[3841]:  flushing old values
2023:09:19-07:17:14 3gmanu-fw01 [daemon:debug] rrdcached[3841]:  rotating journals
2023:09:19-07:17:14 3gmanu-fw01 [daemon:debug] rrdcached[3841]:  started new journal /var/log/reporting/rrd/rrd.journal.1695122234.783300
2023:09:19-07:17:14 3gmanu-fw01 [daemon:debug] rrdcached[3841]:  removing old journal /var/log/reporting/rrd/rrd.journal.1695115034.783289

Not sure what to do here, or what this is about?

Thanks,

								


				
				
		

			
						
									
									
						
						
			
			
			
			
		


			





	

		
	











	

	

					



			








	
	
	
	



Parents
	
    
	

  • 
	
    



	
		
	
	



    
	
    
		
    
							
					
    
		
    
			
													0
							
			
				
									
							
						
				
			
					
    
	
    

		
		
    
					
    This can be closed now. 
    

    

    After looking through my old posting history here. I noticed on one of my earlier posts someone had shared their reporting directory content which had more than just psgsql and rrd in it, so I created those folders, one was accu, afterwards deleting the content of the /rrd folder and removing the rrd folder, recreating and adding the permissions (as shown in another thread) afterwards my CPU was has been running at 93 to 96% for months is back down to 2 - 7%. 

    I no longer see the Accu errors in the fallback log. 

    The DNS errors is the only thing I see now. 

    Also the Network Usage in Logging & Reporting still produced the 624 error so I did a DB rebuild and will leave it for a while before going back into it. Maybe it will fix itself. 

    Note:
    

    I find it funny that Sophos' L2 engineer was quick to tell me that we have 172 devices behind our firewall and because the SG125W was designed to only support 40 devices that's why my CPU was spiking. I guess he was too F'n comfortable in his job to give a rats ass. I knew sooner or later I would figure it out and start to get things back on track. Slight smile

    I would like to know if there is a way to drill into the DNS error in the system log to figure out what is causing the error specifically. Because I followed Sophos' own best practice KB for setting up DNS, and I tried it my way. Both ways ended up with the same results. So, I went back to the best practice. 
    
				                    
    
                
    
            
    
        	
    

		
		
		
		
	
    
	
    
		
    
			
		
    
	
    
	
    
		
						
						
				
						
				
				
		
		
    
			
		
    
	
    

    

    • 

	




Reply

    


  • 
	
    



	
		
	
	



    
	
    
		
    
							
					
    
		
    
			
													0
							
			
				
									
							
						
				
			
					
    
	
    

		
		
    
					
    This can be closed now. 
    

    

    After looking through my old posting history here. I noticed on one of my earlier posts someone had shared their reporting directory content which had more than just psgsql and rrd in it, so I created those folders, one was accu, afterwards deleting the content of the /rrd folder and removing the rrd folder, recreating and adding the permissions (as shown in another thread) afterwards my CPU was has been running at 93 to 96% for months is back down to 2 - 7%. 

    I no longer see the Accu errors in the fallback log. 

    The DNS errors is the only thing I see now. 

    Also the Network Usage in Logging & Reporting still produced the 624 error so I did a DB rebuild and will leave it for a while before going back into it. Maybe it will fix itself. 

    Note:
    

    I find it funny that Sophos' L2 engineer was quick to tell me that we have 172 devices behind our firewall and because the SG125W was designed to only support 40 devices that's why my CPU was spiking. I guess he was too F'n comfortable in his job to give a rats ass. I knew sooner or later I would figure it out and start to get things back on track. Slight smile

    I would like to know if there is a way to drill into the DNS error in the system log to figure out what is causing the error specifically. Because I followed Sophos' own best practice KB for setting up DNS, and I tried it my way. Both ways ended up with the same results. So, I went back to the best practice. 
    
				                    
    
                
    
            
    
        	
    

		
		
		
		
	
    
	
    
		
    
			
		
    
	
    
	
    
		
						
						
				
						
				
				
		
		
    
			
		
    
	
    

    

    • 





Children
	
No Data


		
			





















































			











Unfiltered HTML