Logging & Reporting - Clarification Needed

Question

Hi all, 
 Our current setup is two SG450 Hardware Appliances running Version 9.411-3 in a Hot-Standby (Active-Passive) configuration. 
 We're hoping someone will be able to set us straight on a few things in relation to logging and reporting on the Sophos UTM Hardware Appliance. 
 We have a support call open with Sophos in relation to an issue whereby scheduled reports on sites blocked by the web filter are coming back blank, despite the fact that the log files are recording sites being blocked by our configured web filtering policies. 
 One of the recommendations of Sophos Support is that we rebuild the database using the command: /etc/init.d/postgresql92 rebuild . 
 Whilst we aren't opposed to doing this, we do want to clarify what will actually happen when this process is run. It is our understanding that archived logs will not be affected, is this true? 
 If the log files are retained, does the reporting utility use these logs to generate future reports on web usage? 
 Finally, does the process for rebuilding the database differ in a High Availability (Hot-Standby) configuration and will there be any downtime? 
 Many thanks for your assistance in this matter, 
 John P

BAlfson · Accepted Answer

John, I think Sachin is confusing two different processes, but his recommendation to use a syslog server is a good one in an organization as large as yours. 
 The rebuild command affects only the PostgreSQL data bases, not the logs. It does delete all current information in graphs and all data in Reporting. These are not repopulated from the logs. The logs are not used at all in Reporting as these two sets of files are created separately and at different times. The only PostgreSQL database that is rebuilt is the Email Quarantine. 
 Cheers - Bob

sachingurung · Answer

Hi John, 
 Rebuilding postgres will not affect the archived logs, it will only purge the active logs that are yet to be archived. The log files cannot be ratained which are purged during the rebuild. I would suggest you, deploy a syslog server (one of ours Sophos iView) which can keep a separate track of reports and logs. 
 There will be no downtime during the rebuild process, with HA in the scenario, what I will do is; shut down the Auxilliary appliance and rebuild the Master. Start the Auxilliary appliance and rebuild it. 
 Thanks