Group, please check your UTMs snort logs. Could it be for some reason (maybe faulty pattern) snort stopped at around 07:20pm CET on all UTMs? Or would this be just an instance and the others might still run?
I checked it, snort is indeed running but i find it strange that at around this very timeframe all utms would exit some ids instance.
I didn't see anything on 18 Jan, Jörg, but I do see that Snort restarted in our UTM at 7:18 PM CET on 19 Jan immediately after the Up2Date log shows that ipsbundle2-9.381 was installed.
Cheers - Bob
Thanks Bob. I have never before dealt intensively with it and researched. I will keep an eye on it. It's interesting in any case. Cheers - Jörg