Help us enhance your Sophos Community experience. Share your thoughts in our Sophos Community survey.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 9 replies
  • Subscribers 3 subscribers
  • Views 20511 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[Solved]UTM problems with rrdcached since 9.315-2

cwoller
Hi. 

Since the update to 9.315-2, the UTM 320 is slow on speed and we got tons of erros from rrdcached. The "Fallback" log fills up with messages like this:

2015:08:18-08:43:44 han-e7-secapp [daemon:notice] rrdcached[10060]: queue_thread_main: rrd_update_r (/var/log/reporting/rrd/apusage_A400175F685D801.rrd) failed with status -1. (/var/log/reporting/rrd/apusage_A400175F685D801.rrd: illegal attempt to update using time 1439323024 when last update time is 1439323085 (minimum one second step))

and this

2015:08:18-08:44:19 han-e7-secapp [daemon:info] rrdcached[10124]: starting up
2015:08:18-08:44:19 han-e7-secapp [daemon:info] rrdcached[10124]: checking for journal files
2015:08:18-08:44:19 han-e7-secapp [daemon:notice] rrdcached[10124]: replaying from journal: /var/log/reporting/rrd/rrd.journal.1439316807.508822

Every hour we get emails with this subject:

[INFO-192] RRD cache daemon not running - restarted

Has anybody seen this before or has any hit to solve this? 

I tried google on this but it seams to me, that his error is a kind of special on our system.

Any hint is welcome.

Best regards, Christian


This thread was automatically locked due to age.
Parents
  • +1
    NOTE: If you have this issue, please read the rest of the thread before trying anything.

    Re-imaging from ISO might be necessary, but I definitely would get Sophos Support involved first.

    If Support tells you to re-image, try the following first as root at the command line:
    cd /var/up2date/sys
    echo ' 9.313003'>/etc/version
    wget ftp.astaro.com/.../u2d-sys-9.313003-314013.tgz.gpg
    wget ftp.astaro.com/.../u2d-sys-9.314013-315002.tgz.gpg
    /sbin/auisys.plx --showdesc

    Then install in WebAdmin.

    That has the effect of re-applying the Up2Dates as one of them might have been corrupted.  The advantage is that it preserves Reporting, Graphs and Logs.

    If that doesn't solve it, try the following to re-initialize the data behind the graphs:

    rm /var/log/reporting/rrd/*
    /etc/init.d/syslogng restart
    /etc/init.d/rrdcache restart
    /usr/local/bin/reporter/system-reporter.pl



    Finally, as a last resort, try reinitializing the PostgreSQL data bases used by Reporting:

    /etc/init.d/postgresql92 rebuild



    Please let us know if you try any of that and what, if anything, solved the issue.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • +1
    NOTE: If you have this issue, please read the rest of the thread before trying anything.

    Re-imaging from ISO might be necessary, but I definitely would get Sophos Support involved first.

    If Support tells you to re-image, try the following first as root at the command line:
    cd /var/up2date/sys
    echo ' 9.313003'>/etc/version
    wget ftp.astaro.com/.../u2d-sys-9.313003-314013.tgz.gpg
    wget ftp.astaro.com/.../u2d-sys-9.314013-315002.tgz.gpg
    /sbin/auisys.plx --showdesc

    Then install in WebAdmin.

    That has the effect of re-applying the Up2Dates as one of them might have been corrupted.  The advantage is that it preserves Reporting, Graphs and Logs.

    If that doesn't solve it, try the following to re-initialize the data behind the graphs:

    rm /var/log/reporting/rrd/*
    /etc/init.d/syslogng restart
    /etc/init.d/rrdcache restart
    /usr/local/bin/reporter/system-reporter.pl



    Finally, as a last resort, try reinitializing the PostgreSQL data bases used by Reporting:

    /etc/init.d/postgresql92 rebuild



    Please let us know if you try any of that and what, if anything, solved the issue.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • 0 in reply to BAlfson


    rm /var/log/reporting/rrd/*
    /etc/init.d/syslogng restart
    /etc/init.d/rrdcache restart
    /usr/local/bin/reporter/system-reporter.pl



    /etc/init.d/postgresql92 rebuild





    Good morning Bob.

    I tried the above commands and for the last 15 minutes, I dont get any error messages. rrdcached cames up with

    2015:08:20-07:29:31 han-e7-secapp [daemon:info] rrdcached[28380]: clean shutdown; all RRDs flushed 
    2015:08:20-07:29:31 han-e7-secapp [daemon:info] rrdcached[28380]: removing journals 
    2015:08:20-07:29:31 han-e7-secapp [daemon[:D]ebug] rrdcached[28380]: removing old journal /var/log/reporting/rrd/rrd.journal.1440048086.534901 
    2015:08:20-07:29:31 han-e7-secapp [daemon:info] rrdcached[28380]: goodbye 
    2015:08:20-07:29:32 han-e7-secapp [daemon:info] rrdcached[29948]: starting up 
    2015:08:20-07:29:32 han-e7-secapp [daemon:info] rrdcached[29948]: checking for journal files 
    2015:08:20-07:29:32 han-e7-secapp [daemon[:D]ebug] rrdcached[29948]: started new journal /var/log/reporting/rrd/rrd.journal.1440048572.492666 
    2015:08:20-07:29:32 han-e7-secapp [daemon:info] rrdcached[29948]: journal processing complete 
    2015:08:20-07:29:32 han-e7-secapp [daemon:info] rrdcached[29948]: listening for connections 



    and I am not an expert, but this looks pretty good to me :-) The Webadmin is pretty much more responsive than before. 

    I will watch this over the day.

    Thank you Bob for your help :-)

    Best regards, Christian
  • 0 in reply to cwoller
    Hi Bob. 

    I wanted to let you know, that the error not happend again.

    So, the case is closed.

    My UTM is happy again, so am I [:D]

    Once again, thank you Bob.

    Best regards, Christian

    PS: Ok, this may be a stupid question but how can I marke this thread as solved? Changing the title from my first post does not work as expected...
Unfiltered HTML