was ist das -> ulogd[51205]: ipf: recv: Connection refused

I have learned what these messages mean.

If "IPFIX Accounting" is enabled, but the Host specified is rejecting the connection then these messages are logged in "system.log"

In UTM 9 this setting is located under Logging & Reporting > Reporting Settings > Settings tab, all the way at the bottom of the page.

If the Host specified is not allowing Sophos to send the IPFIX data then you get the "system.log" message for every attempt to send:

2022:11:23-12:53:14 xxxxxxxx ulogd[946]: ipf: recv: Connection refused

2022:11:23-12:53:15 xxxxxxxx ulogd[946]: ipf: recv: Connection refused

2022:11:23-12:53:15 xxxxxxxx ulogd[946]: ipf: recv: Connection refused

2022:11:23-12:53:15 xxxxxxxx ulogd[946]: ipf: recv: Connection refused

2022:11:23-12:53:15 xxxxxxxx ulogd[946]: ipf: recv: Connection refused

To prevent this the Host specified must be setup to allow receiving the IPFIX data from Sophos according to the specification in "IPFIX Accounting"

In my case I disabled IPFIX for now as the receiving Host became unlicensed and that is why it was rejecting the IPFIX data from Sophos.

I hope this helps you

I have learned what these messages mean.

If "IPFIX Accounting" is enabled, but the Host specified is rejecting the connection then these messages are logged in "system.log"

In UTM 9 this setting is located under Logging & Reporting > Reporting Settings > Settings tab, all the way at the bottom of the page.

If the Host specified is not allowing Sophos to send the IPFIX data then you get the "system.log" message for every attempt to send:

2022:11:23-12:53:14 xxxxxxxx ulogd[946]: ipf: recv: Connection refused

2022:11:23-12:53:15 xxxxxxxx ulogd[946]: ipf: recv: Connection refused

2022:11:23-12:53:15 xxxxxxxx ulogd[946]: ipf: recv: Connection refused

2022:11:23-12:53:15 xxxxxxxx ulogd[946]: ipf: recv: Connection refused

2022:11:23-12:53:15 xxxxxxxx ulogd[946]: ipf: recv: Connection refused

To prevent this the Host specified must be setup to allow receiving the IPFIX data from Sophos according to the specification in "IPFIX Accounting"

In my case I disabled IPFIX for now as the receiving Host became unlicensed and that is why it was rejecting the IPFIX data from Sophos.

I hope this helps you

Morning!

Thanks for your response! You are very right with this. My disk on the netflow collector was filled to the brim. Netflow "flows" again and the errors are gone!

Thanks a lot.