ssl_handshake: Input/output error Are only logs in Web Filter

Question

Since reenabling the "decrypt and scan" transparent part of the UTM that acts of my gateway, the only logs I see in Web Filtering are these. Just tons and tons of these. Never any actual connections, URLs, user agents, or categories (as it used to be). This makes it REALLY hard to troubleshoot when a certain application or website does not work (but disabling Web Filtering WILL cause that application to work so I know the issue resides with that feature) since I do not know what it tried to access or how it was blocked. Restarted endpoints, applications, the Sophos UTM, Web Filtering all do not matter. Suffice to say, this is very annoying; does anyone have any suggestions? Thank you. 
 
 Certificates for the Decrypt function are installed on the endpoints to remediate those warnings. I warn on "uncategorized" and for some applications, you'll never see this unless you look in the logs to see where it was trying to connect to. For the end user they'll just be stuck waiting for a load or get a generic error. 
 
 2019:06:30-17:23:34 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xcc0ff800" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:23:44 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xd0c40e00" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:23:55 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xd11c2300" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:24:05 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xc86b9100" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:24:15 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xd1028700" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:24:26 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xd1685c00" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:24:36 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x1143aa00" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:24:46 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xd04f9c00" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:24:57 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xc80a7500" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:25:07 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xd076d500" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:25:18 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xd17ebc00" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:25:28 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xdcd2c700" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:25:38 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xa5f7100" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:25:49 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xdcd2d500" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:25:59 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xd0604e00" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 2019:06:30-17:26:10 SophosUTM httpproxy[31761]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xcc0fc000" function="ssl_connect" file="ssl.c" line="1654" message="ssl_handshake: Input/output error" 
 
 The forums, to post a new message or join a group, do not seem to work with well with the latest version of Chrome?

Briain · Answer

Hi 
 I just found an absolutely excellent new Sophos tutorial titled 'Sophos UTM: How to capture packets and download the Packet Capture' (published 27 Jun 2019) at the below link: 
 https://community.sophos.com/kb/en-us/134286 
 So, regarding the iOS BBC weather app I mentioned above, I just SSH'd into UTM and ran the command noted in that excellent tutorial (using my iPad's IP address to filter the capture), then I started the BBC weather app, waited for it to show a failure then used Ctrl+c (on the SSH terminal) to stop the capture. I then downloaded the pcap file from the UTM web interface (at https://<UTM hostname:Port>/tcpdump.pcap; that is a great feature) and opened it in Wireshark. It only took a few seconds to then find the below 'suspicious' looking entry: 
 weather-broker-cdn.api.bbci.co.uk (noting the 'i' after the 'bbc') 
 I then changed my existing BBC exception from ^https?://[A-Za-z0-9.-]*\.bbc\.co\.uk/ to instead being ^https?://[A-Za-z0-9.-]*\.bbci?\.co\.uk/ and started the BBC weather app, which now works perfectly (unlike the Scottish weather, of course)! :-P 
 Problem solved; I can now repeat the process for the other apps that failed to start (and were resulting in the generation of these ' input/output error' log entries). 
 So, please do excuse me for 'shouting' this from the rooftops but... 
 Thank you very much indeed for writing that great tutorial, Sophos! :-) 
 Kind regards, 
 Briain (a very happy Briain)