Sophos UTM: After Update to 9.719 IPS not working and Snort not running

Sobald ich was höre melde ich mich hier.

Now  :-(

Your case requires additional assistance from our global escalation specialists (GES). GES engineers are the highest technical tier within support and are responsible for interacting with our development teams. A GES engineer will review your case and provide the necessary expertise needed for resolution.
Based on the case priority and complexity, they will contact you with their initial analysis within a maximum of 3 business days.

Vivek Jagad Are you serious about Sophos? The update blog post doesn't even have a warning until today. What are you doing?

Hey IT-Admin007 & SZSZ the cases are escalated to GES which is the highest level of support, further they'll check with the dev and create an known issue ID to track (As of now suspected issue is:  NUTM-10489). We'll get this expedited on priority !

I can confirm that since today there's an issue with snort. I get mails that snort isn't running on the master node and is restarted. I updated my UTM Home HA cluster yesterday. Maybe this isn't related to the update itself but to a pattern update?

On 07:11 I got this pattern update:

New Pattern Up2Dates have been installed. The current pattern version
is now 9.56051.

Since 07:23 I get the mail messages that snort isn't running and restarted.

Hello Community,

If you are being affected by this, please run the following command from root #

cc set ips snortsettings disable_normalization 1

And confirm the setting has changed to 1 by running the following command

cc get ips snortsettings disable_normalization

Note: This command will restart snort automatically

Additionally, if the issue persists after you entered the commands, please open a case with Support and mention NUTM-14593

Regards,

Hi, thanks for the quick reaction.
Setting made, no problems so far.
The actual test takes place on Monday morning under normal load.

Hello Community,

The following KB has been released.

https://support.sophos.com/support/s/article/KB-000045966?language=en_US

Regards,

If the u2d-ipsbundle has been updated, should we be turning snort normalization back on?

Yes, it looks like this workaround solves the issue.