This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM 9 Resets to Factory default every couple days

Hello everyone,

I'm having this issue with a UTM 9 running on a Linux platform, on an HP Desktop PC. I'm using this UTM 9 in a Home environment, since 2015, an every now and again the UTM will reset to factory default. I first noticed this occurrence a few months back, and thought it had something to do with the Up2date automatic installation. So, I changed the installation to manual... However, I'm still experiencing this factory reset issue, and it would appear this happens mostly in the evening hour after 11:00 PM. In order to restore the system, I have to restore from backup, and the UTM is back online. This is happened three times in a week.

Where can I look to begin troubleshooting this issue? Which log can I review?

I have recently rebuild the UTM and brought the firmware to the latest revision about two mouths ago, but still the same issue. There must be a log or event I can review to help me understand what might be causing this issue.

Any help would be appreciated.

Firmware 9.506.2

Pattern 137589

James

This thread was automatically locked due to age.

Parents

0 CS over 6 years ago

Hi James,

i have never observed such a behavior with UTM last 10 years.

- Make shure that nobody is fooling You! Change Admin and SSH Passwords, disable all other admin accounts.

- Disable BIOS remote access / IPMI (if any)

- Look into the pc hardware. Is there a card like this https://www.amazon.de/Dr-Kaiser-01-1012-PC-W%C3%A4chter-PCI-Karte/dp/B003Z17K8G

(Used in schools to switch back the disk configuration)

- Install a syslog server and configure log shipping to get some logs...

- Change the hardware.

Good Luck!

CS

Sophos Certified Architect (UTM + XG)
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 CS over 6 years ago

Hi James,

i have never observed such a behavior with UTM last 10 years.

- Make shure that nobody is fooling You! Change Admin and SSH Passwords, disable all other admin accounts.

- Disable BIOS remote access / IPMI (if any)

- Look into the pc hardware. Is there a card like this https://www.amazon.de/Dr-Kaiser-01-1012-PC-W%C3%A4chter-PCI-Karte/dp/B003Z17K8G

(Used in schools to switch back the disk configuration)

- Install a syslog server and configure log shipping to get some logs...

- Change the hardware.

Good Luck!

CS

Sophos Certified Architect (UTM + XG)
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 james Perconte over 6 years ago in reply to CS

Thanks for the reply.

If the system was reset to factory default via the config. Wouldn't this show somewhere in the log? Changing the password is not a bad idea either. Thanks again.

I thought about the syslog server, I have to check my Qnap is see if the service available, than I can dump the log to it.
Cancel
Vote Up 0 Vote Down

Cancel
0 CS over 6 years ago in reply to james Perconte

Hi James,

"Reset to factory defaults" means clearing the configuration and all the log files.

Sophos Certified Architect (UTM + XG)
Cancel
Vote Up 0 Vote Down

Cancel