SG105 failure due to http-proxy resource usage

Hi FFin ,

Thank you for reaching out to the community, have you seen impact with the users apart from the resource utilization going high ?
Can you Sophos UTM: Monitor resource utilization history via atop ?

And apart from that have you seen any coredumps under the directory cd /var/storage/cores ?

Yes, impact is that UTM become inaccessible, offline and network goes down until hardware-reboot onsite.
Some of these are offsite-locations with 1 PCs and usually no web-traffic at all. Or just some background-monitoring and remote-access. Even an SG105 should be able to handle this.

Here coredump-folders of three independent diffrent SG105 customers facing these issues and outages within last 48 hours:

And we have a few more appliances with this within the last weeks....

I fear more outages enabling "atop" on these devices, that will lead to even more resouce usage..

Shall we raise support cases for one or more of these SG105s?

Please raise a support service request and share us the case id here, so that we can expedite the reported situation... 

Hi Vivek Jagad , thanks! I've raised Case #07368170.

Thank you will get this expedited...FFin 

Hi FFin ,

Based on the logs, the device is running out of the memory:
2024:05:24-06:56:57 gate-nordoe kernel: [3076892.143099] Out of memory: Kill process 29063 (httpproxy) score 79 or sacrifice child
2024:05:24-06:56:57 gate-nordoe kernel: [3076892.143107] Killed process 29063 (httpproxy) total-vm:669836kB, anon-rss:317440kB, file-rss:0kB
2024:05:24-07:00:48 gate-nordoe kernel: [ 130.416723] hwinfo: vm86 mode not supported on 64 bit kernel

Current utilization stands at 84%

Yes, but why? It‘s not undersized according to sizing guide. WebProtection has been configured since first rollout. And there‘s no usage growth on network within last years.

So why is memory a problem with webfilter just being enabled since a few weeks/month?

On multiple appliances of this size..

Our team will investigate on this and provide you an update on the service request, meanwhile I see there is an update available - UTM Up2date 9.7 MR19 (9.719) released | See if upgrading the appliance helps stabilize the reported situation...

Thank you, the issue persists through the last 3 up2date releases and there‘s nothing about http-Proxy in release notes. So I guess that will not change, but I’ll keep that in mind.

Thank you for the background, will keep you posted on the investigation...

I've compared yearly hardware-usage graph on 4 SG105 appliances (different customers and usage profiles).
Swap usage average and peaks increased since beginning of this year at all four of them:

Looks like some (pattern-)updates(?) causes SG105-appliances no longer being able to make use of WebProtection module at all...

Disabling WebProtection completely (from url filtering only) will immediately drop hardware usage (as expected):

On slightly greater appliances like SG115 you can see swap increase as well around the same time, but here it's not killing the hardware:

I've compared yearly hardware-usage graph on 4 SG105 appliances (different customers and usage profiles).
Swap usage average and peaks increased since beginning of this year at all four of them:

Looks like some (pattern-)updates(?) causes SG105-appliances no longer being able to make use of WebProtection module at all...

Disabling WebProtection completely (from url filtering only) will immediately drop hardware usage (as expected):

On slightly greater appliances like SG115 you can see swap increase as well around the same time, but here it's not killing the hardware: