[INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

isoffice — Tue, 08 Aug 2017 07:44:37 GMT

Please ignore my last post folks.

By using the command ha_utils ssh I was able to connect to the Standby Unit via the Primary and examine the contents of /var/storage/cores. I then removed the coredumps created by this issue.

Best regards,

John P

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

isoffice — Tue, 08 Aug 2017 07:17:24 GMT

A Sophos advisory (community.sophos.com/.../127257) outlines how to delete the coredumps created by this issue.

I have done this, but as we are running an Active-Standby configuration it has prompted me to ask the question: Can I connect directly to the Standby Unit via SSH to examine the contents of /var/storage/cores or do I have to SSH to the Primary Unit and connect from there? If I have to go via the Primary Unit, what command would permit me to connect to the Standby Appliance.

Many thanks,

John P

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

RedVision81 — Tue, 08 Aug 2017 02:41:47 GMT

everything above 130311 should solve the problem.

currently we are running 130350 and have no issues anymore.

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

B731 — Tue, 08 Aug 2017 02:30:16 GMT

Hello,

which pattern version is the newest? Is it 130350 which solve the problem?

Best regards,

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

Mateusz Bender — Mon, 07 Aug 2017 23:37:36 GMT

[quote user="William Duke"]

The storage partition is still full. Do we need to manually clean it? If so, can you post instructions?[/quote]

Login into the CLI (either via SSH or hook up a keyboard + monitor to the physical appliance or open the host console on a virtual appliance). Type in:

cd /var/storage/cores/
rm *

The above will remove all the core dumps ever generated and should free up the storage partition.

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

William Duke — Mon, 07 Aug 2017 20:24:39 GMT

The storage partition is still full. Do we need to manually clean it? If so, can you post instructions?

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

Dennis Reijbroek — Mon, 07 Aug 2017 08:49:25 GMT

It's here also working again.

Thanks for the support.

Regards

Dennis

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

Jannikvan Schaik — Mon, 07 Aug 2017 08:47:26 GMT

With pattern version 130311 or higher works all fine. All issues are solved.

kind regards,

Jannik

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

isoffice — Mon, 07 Aug 2017 07:17:38 GMT

Our UTM Appliances have now upgraded the Pattern Version to Version 130311.

I have re-enabled Application Control and I'm monitoring the Kernel Log live.

So far, in the fifteen minutes or so since I re-enabled Application Control there have been no further 'segfault' entries in the log file.

Looks like the issue has been resolved.

Best regards,

John P

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

NathanRamsden-Lock — Mon, 07 Aug 2017 07:16:13 GMT

I checked my up2date log to make sure we have received the new application control pattern u2d-appctrl43-9-42 (as mentioned in https://community.sophos.com/kb/en-us/127257) and can confirm that it has resolved the problem here.

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

zaphod — Mon, 07 Aug 2017 07:05:25 GMT

my cluster installed fix too.. Make sure you enable application control first then update patterns...

Cluster is working "fine" again... no memory consumption, no slow surfing... no phone calls "all is slow"... looking good ;-)

2017:08:07-13:59:11 vpn-2 auisys[14144]: Install u2d packages <aptp>
2017:08:07-13:59:11 vpn-2 auisys[14144]: Starting installing up2date packages for type 'aptp'
2017:08:07-13:59:11 vpn-2 auisys[14144]: Installing up2date package: /var/up2date/aptp/u2d-aptp-9.24553.tgz.gpg

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

Marco A — Mon, 07 Aug 2017 06:59:01 GMT

looks like issue is fixed with pattern 130311

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

R0n1 — Mon, 07 Aug 2017 06:46:37 GMT

A new pattern called u2d-appctrl43-9-42 was recently released to resolve this issue.

Source: https://community.sophos.com/kb/en-us/127257

I checked my up2date logs: it installed around 10 minutes ago with pattern update# 130311

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

twister5800 — Mon, 07 Aug 2017 06:42:33 GMT

I now get a lot of (from the customers):

Data Disk is filling up - please check. Current usage: 82%

For several of our managed UTM's, this is due to this bug with HTTPPROXY Core dumps.

As the bug is going to be fixed, you can safely backup or delete the dumps, (I deleted them :-) )

As you can see the httpproxy.NAVLWorker files are huge!

I just did a "rm *" in the /var/storage/cores folder and all is good, as I do not need the other dumps either, else you can just delete with "rm httpproxy.*":

HTH :-)

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

renehoehle — Mon, 07 Aug 2017 05:54:55 GMT

There are a lot of posts explain that and an official statement.

https://community.sophos.com/kb/en-us/127257

So we wait for the fixed patterns and in my case it was enough to disable the Application Control.

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

Jannikvan Schaik — Mon, 07 Aug 2017 05:51:49 GMT

Dear Community,

i have a workaround which fixed this issue with the webfilter:

disable ApplicationControl
disable AV scanning in the filter actions

On the one hand customer needs one of the points to disable and by other customer both to disable.

kind regards,

Jannik

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

isoffice — Mon, 07 Aug 2017 05:35:13 GMT

We have 2 X SG450 UTM Appliances (Firmware 9.500-9, Pattern Version 130305) running in Active-Passive Mode.

As advised, we disabled Application Control and this stopped 'segfault' entries appearing in the Kernel Log.

Awaiting response from Sophos Support for a proper fix.

John P

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

zaphod — Mon, 07 Aug 2017 05:32:41 GMT

same here... disabling application control fixes the slow httpd and the memory consumption....

but now all the clients can start and use applications i dont want them to use...

hope there will be a fast fix...

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

Mateusz Bender — Mon, 07 Aug 2017 05:30:56 GMT

Which command are you using?

For me, I'm using the web interface and the logs just show this:

2017:08:07-12:27:29 srv-gw-p08 audld[5932]: no HA system or cluster node
2017:08:07-12:27:29 srv-gw-p08 audld[5932]: Starting Up2Date Package Downloader
2017:08:07-12:27:30 srv-gw-p08 audld[5932]: patch up2date possible
2017:08:07-12:27:32 srv-gw-p08 audld[5932]: id="3701" severity="info" sys="system" sub="up2date" name="Authentication successful"

After that nothing happens and the pattern version remains unchanged (currently sitting at 130303)...

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

renehoehle — Mon, 07 Aug 2017 05:29:11 GMT

Ok the Webfilter isn't the problem...

Starting Up2Date Download

No new packages available, exiting.

I can't get the last pattern

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

Tom van den Heuvel — Mon, 07 Aug 2017 05:22:22 GMT

For me it helped to disable webfiltering.

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

renehoehle — Mon, 07 Aug 2017 05:20:37 GMT

In the web interface i can see that there is a new version: 130308

When i start the update manually it's not working. So i've started the update over the CLI and get the following error:

>>> Modules::Audld::LocalRestriction::_seek_own_country::115()

Could not connect to Server us1.utmu2d.sophos.com (status=500 Internal Server Error).

Is that the reason why i don't get any new patterns?

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

sachingurung — Mon, 07 Aug 2017 04:33:51 GMT

The issue is mentioned in NUTM-8565, please contact support to link your cases to it. Please be assured that I'll update with all the information I receive.

Thanks

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

Samet Topac — Mon, 07 Aug 2017 04:30:30 GMT

it is not fixed with 130305 release

RE: [INFO-141] Http proxy not running - restarted notification + segfaults in kernel log since this morning

R0n1 — Mon, 07 Aug 2017 04:29:37 GMT

I assume it's not fixed with pattern update 130305, Sophos just twittered this as the official workaround: community.sophos.com/.../127257

What to do

Disable application control until the issue is resolved.