Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 11 replies
  • Subscribers 11 subscribers
  • Views 2334 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Endpoint for Mac HUGE log sizes

TijsKeijsers

I've been noticing that my system volume is getting used up pretty fast. See attached screenshot for the sizes.

The content below is a part of the log text which keeps on repeating.

Any ideas?

'agent-relay.1.log' is 5.2 GB

2020-07-28 20:10:38.334 +0200 [] [BpmBgTimer] INFO n.mojave.netguard.relay.bpm.Bpm - Config has enabled flag set to false, disabling relay
2020-07-28 20:10:38.334 +0200 [] [BpmBgTimer] INFO n.mojave.netguard.relay.bpm.Bpm - disable tcp redirect
2020-07-28 20:10:38.334 +0200 [] [BpmTopicMsgDelivery] INFO n.m.n.r.b.BpmBasicTopicSubscribers - scheduling my ip lookup retry
2020-07-28 20:10:38.334 +0200 [] [BpmBgTimer] INFO n.mojave.netguard.relay.bpm.Bpm - disable tcp redirect status=0
2020-07-28 20:10:38.334 +0200 [] [BpmBgTimer] INFO n.mojave.netguard.relay.bpm.Bpm - Successfully disabled tcp traffic redirector rules , status=0x0
2020-07-28 20:10:38.661 +0200 [] [BpmBgTimer] INFO n.m.n.r.b.BpmBasicTopicSubscribers - retrying to get the perceived ip to check if relay is disabled on this network
2020-07-28 20:10:38.713 +0200 [] [BpmBgTimer] ERROR n.m.n.relay.utils.NetworkUtils - Direct internet reachability test failed
java.net.SocketException: Too many open files
at java.net.Socket.createImpl(Socket.java:460)
at java.net.Socket.connect(Socket.java:587)
at sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:668)
at sun.net.NetworkClient.doConnect(NetworkClient.java:175)
at sun.net.www.http.HttpClient.openServer(HttpClient.java:432)
at sun.net.www.http.HttpClient.openServer(HttpClient.java:527)
at sun.net.www.protocol.https.HttpsClient.<init>(HttpsClient.java:275)
at sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:371)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1104)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:998)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1512)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1440)
at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:338)
at net.mojave.netguard.relay.utils.NetworkUtils.fetchUrl(NetworkUtils.java:278)
at net.mojave.netguard.relay.utils.NetworkUtils.getPerceivedIp(NetworkUtils.java:101)
at net.mojave.netguard.relay.utils.NetworkUtils.getPerceivedIp(NetworkUtils.java:76)
at net.mojave.netguard.relay.utils.NetworkUtils.getPerceivedInetAddress(NetworkUtils.java:57)
at net.mojave.netguard.relay.bpm.BpmBasicTopicSubscribers._isPerceivedAddressInSourceWhitelist(BpmBasicTopicSubscribers.java:1545)
at net.mojave.netguard.relay.bpm.BpmBasicTopicSubscribers.access$200(BpmBasicTopicSubscribers.java:92)
at net.mojave.netguard.relay.bpm.BpmBasicTopicSubscribers$15$1.run(BpmBasicTopicSubscribers.java:869)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)

......................................

'relay-error.log' is 1.71 GB

socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files
socket SYSPROTO_CONTROL: Too many open files

......................................

'relay-output.log' is 1.28 GB

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

Error getting ctl_info struct ready

 

......................................



This thread was automatically locked due to age.
Parents
  • 0

    Hi

    Can you please confirm the location where you found these logs? 

    Thanks,
    Yashraj Singha
    Manager | Global Community Support
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to TijsKeijsers

    What version of Sophos are you running? 

    What version of the OS are you running?

    RichardP

    Program Manager, Support Readiness | CISSP | Sophos Technical Support
    Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.

  • 0 in reply to RichardP

    Hi Richard,

    The latest for both:

    - Sophos Endpoint 9.9.8
    - MacOS 10.15.6

  • +1 in reply to TijsKeijsers

    This is weird, now it seems that the log sizes has been shrinking to 52 MB max.

    I'm going to monitor this and let you know when it comes back again.

    It's solved so far for me now.

  • 0 in reply to TijsKeijsers

    Hi  

    That's great news! Please do reach out to us if you need any further assistance with this. 

    Thanks,
    Yashraj Singha
    Manager | Global Community Support
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to Yashraj S

    What was done to resolve this issue? We are experiencing the same issue and support haven't been much help so far. In the logs we are just seeing the following, repeated over and over again.

     

    2020-07-28 13:15:00.749 +0100 [] [BpmBgTimer] INFO  n.mojave.netguard.relay.bpm.Bpm - Config has enabled flag set to false, disabling relay

    2020-07-28 13:15:00.749 +0100 [] [BpmTopicMsgDelivery] INFO  n.m.n.r.b.BpmBasicTopicSubscribers - scheduling my ip lookup retry

    2020-07-28 13:15:00.783 +0100 [] [BpmBgTimer] INFO  n.mojave.netguard.relay.bpm.Bpm - disable tcp redirect

    2020-07-28 13:15:00.807 +0100 [] [BpmBgTimer] INFO  n.mojave.netguard.relay.bpm.Bpm - disable tcp redirect status=0

    2020-07-28 13:15:00.807 +0100 [] [BpmBgTimer] INFO  n.mojave.netguard.relay.bpm.Bpm - Successfully disabled tcp traffic redirector rules , status=0x0

    2020-07-28 13:15:00.807 +0100 [] [BpmBgTimer] INFO  n.m.n.r.b.BpmBasicTopicSubscribers - retrying to get the perceived ip to check if relay is disabled on this network

    2020-07-28 13:15:00.808 +0100 [] [BpmBgTimer] ERROR n.m.n.relay.utils.NetworkUtils - Direct internet reachability test failed

    java.net.SocketException: Too many open files

                    at java.net.Socket.createImpl(Socket.java:460)

                    at java.net.Socket.connect(Socket.java:587)

                    at sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:668)

                    at sun.net.NetworkClient.doConnect(NetworkClient.java:175)

                    at sun.net.www.http.HttpClient.openServer(HttpClient.java:432)

                    at sun.net.www.http.HttpClient.openServer(HttpClient.java:527)

                    at sun.net.www.protocol.https.HttpsClient.<init>(HttpsClient.java:275)

                    at sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:371)

                    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)

                    at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1104)

                    at sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:998)

                    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)

                    at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1512)

                    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1440)

                    at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)

                    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:338)

                    at net.mojave.netguard.relay.utils.NetworkUtils.fetchUrl(NetworkUtils.java:278)

                    at net.mojave.netguard.relay.utils.NetworkUtils.getPerceivedIp(NetworkUtils.java:101)

                    at net.mojave.netguard.relay.utils.NetworkUtils.getPerceivedIp(NetworkUtils.java:76)

                    at net.mojave.netguard.relay.utils.NetworkUtils.getPerceivedInetAddress(NetworkUtils.java:57)

                    at net.mojave.netguard.relay.bpm.BpmBasicTopicSubscribers._isPerceivedAddressInSourceWhitelist(BpmBasicTopicSubscribers.java:1545)

                    at net.mojave.netguard.relay.bpm.BpmBasicTopicSubscribers.access$200(BpmBasicTopicSubscribers.java:92)

                    at net.mojave.netguard.relay.bpm.BpmBasicTopicSubscribers$15$1.run(BpmBasicTopicSubscribers.java:869)

                    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)

                    at java.util.concurrent.FutureTask.run(FutureTask.java:266)

                    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)

                    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)

                    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

                    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

                    at java.lang.Thread.run(Thread.java:745)

  • 0 in reply to PaulRigby

    Hi  

    Can you please PM me your support case number so that I can check it for you?

    Thanks,
    Yashraj Singha
    Manager | Global Community Support
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to PaulRigby

    Im not sure what specifically fixed it, but id like to know.

  • 0 in reply to PaulRigby

    Hi

    Thank you for providing the case number. I am keeping an eye on the case and will update this thread once there's some interesting development/resolution on the case.

    Thanks,
    Yashraj Singha
    Manager | Global Community Support
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
Reply Children
No Data
Unfiltered HTML