This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Application Control daemon not running - Error initializing instance of plugin HPACK_UTIL

Hi there,

since I upgraded to 9.506-2 I do receive several times a day (sometimes 1-3, sometimes 5 per hour) messages like this:

 

Application Control daemon not running - restarted

HA Status          : HA MASTER (node id: 1)
System Uptime      : 32 days 2 hours 12 minutes
System Load        : 1.09
System Version     : Sophos UTM 9.506-2
 
corresponding kernel message: 
afcd/257[23036]: segfault at e2 ip 00000000f6a56cbd sp 00000000f5854fc0 error 4 in libnavl.so.4.3[f69e5000+9a7000]
 
This is a segfault due to following a null pointer trying to find code to run - and Segfault error 4 means "The cause was a user-mode read resulting in no page being found."
 
afc.log: 

2018:01:03-12:09:47 XYZ-1 ulogd[5608]: id="2017" severity="info" sys="SecureNet" sub="packetfilter" name="AFC Alert" action="log" fwrule="1" outitf="eth1" mark="0x21c0" app="448" srcmac="00:1a:8c:f0:80:a1" srcip="192.168.1.153" dstip="13.107.3.128" proto="6" length="233" tos="0x00" prec="0x00" ttl="62" srcport="50626" dstport="443" tcpflags="ACK PSH" 

2018:01:03-12:09:49 XYZ-1 ulogd[5608]: id="2017" severity="info" sys="SecureNet" sub="packetfilter" name="AFC Alert" action="log" fwrule="1" outitf="eth1" mark="0x21c0" app="448" srcmac="00:1a:8c:f0:80:a1" srcip="192.168.1.186" dstip="13.107.3.128" proto="6" length="225" tos="0x18" prec="0xa0" ttl="126" srcport="55042" dstport="443" tcpflags="ACK PSH" 

2018:01:03-12:09:51 XYZ-2 afcd[2348]: vy_plugin: N: finalizing vineyard thread

2018:01:03-12:09:51 XYZ-2 afcd[2348]: STATUS: alert_lvl="GREEN" run_time=5332 num_cts=0 pktps_avg=0.00 pktps_avg_max=0.00 skipped_pktps_avg=0.00 skipped_pktps_avg_max=0.00 connps_avg=0.00 connps_avg_max=0.00 rusage_sys=0.520 rusage_usr=0.220

2018:01:03-12:09:51 XYZ-2 afcd[2348]: packets: 0 (0 inspected, 0 skipped)

2018:01:03-12:09:51 XYZ-2 afcd[2348]: connections: 0 (0 classified)

2018:01:03-12:09:51 XYZ-2 afcd[8787]: _afc_cfg_file_plugin_parse: 1911 protocols registered

2018:01:03-12:09:52 XYZ-2 afcd[8787]: libnavl: E: InitInstance: Error initializing instance of plugin HPACK_UTIL

2018:01:03-12:09:53 XYZ-2 afcd[8787]: vy_plugin: N: aptp: threaddata loaded from /var/chroot-afc/etc/aptpdata

2018:01:03-12:09:53 XYZ-2 afcd[8787]: loaded plugin '/var/sec/chroot-afc/lib/afc/vineyard.so'

2018:01:03-12:09:53 XYZ-2 afcd[8787]: _afc_cfg_file_plugin_parse: 1911 protocols registered

2018:01:03-12:09:53 XYZ-2 afcd[8809]: AFC ready.

2018:01:03-12:09:57 XYZ-1 ulogd[5608]: id="2017" severity="info" sys="SecureNet" sub="packetfilter" name="AFC Alert" action="log" fwrule="1" outitf="eth1" mark="0x21c0" app="448" srcmac="00:1a:8c:f0:80:a1" srcip="192.168.0.100" dstip="13.107.3.128" proto="6" length="225" tos="0x18" prec="0xa0" ttl="126" srcport="52222" dstport="443" tcpflags="ACK PSH" 

2018:01:03-12:10:16 XYZ-1 ulogd[5608]: id="2017" severity="info" sys="SecureNet" sub="packetfilter" name="AFC Alert" action="log" fwrule="1" outitf="eth1" mark="0x21c0" app="448" srcmac="00:1a:8c:f0:80:a1" srcip="192.168.0.47" dstip="13.107.3.128" proto="6" length="225" tos="0x18" prec="0xa0" ttl="126" srcport="56963" dstport="443" tcpflags="ACK PSH" 

 

 
In Application control log there is nothing logged about this issue.
 
 
Any ideas...?
 
Thanks
 
 
 


This thread was automatically locked due to age.
Parents
  • Hi Chris,

    Could you also check whether you have any afcd coredumps (located in /var/storage/cores)? 

    It sounds like you are affected by a known issue identified as BUG-ID: NUTM-9249

    A fix is currently under testing and estimated to be released between the first or second week of January pending any unforeseen circumstances.

    Thanks,
    Karlos

    Karlos
    Community Support Engineer | Sophos Technical Support

    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.
Reply
  • Hi Chris,

    Could you also check whether you have any afcd coredumps (located in /var/storage/cores)? 

    It sounds like you are affected by a known issue identified as BUG-ID: NUTM-9249

    A fix is currently under testing and estimated to be released between the first or second week of January pending any unforeseen circumstances.

    Thanks,
    Karlos

    Karlos
    Community Support Engineer | Sophos Technical Support

    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.
Children
  • Hi Karlos,

    here we go:

     

      84504 -rw-r--r-- 1 root root   86532096 Jan  4 07:08 afcd.afcd!257.19411

      98776 -rw-r--r-- 1 root root  101142528 Jan  4 07:07 afcd.afcd!258.19222

     107268 -rw-r--r-- 1 root root  109838336 Jan  4 07:45 afcd.afcd!258.19447

      86092 -rw-r--r-- 1 root root   88154112 Jan  4 07:45 afcd.afcd!258.22902

     105672 -rw-r--r-- 1 root root  108208128 Jan  4 08:11 afcd.afcd!259.22956

     

    Cheers, Chris