XG125 100% CPU USAGE

Hi VikenNajarian 

Apologies for this negative experience, I will follow up with your support case accordingly.

Regards,

Hi FloSupport 

Thank you.

In additional information, this morning the CPU usage is normal (in my opinion this is because I disabled SCAN HTTP in the firewall rules).

Regards.

Hi Viken,

What are your configured settings for Malware and Content Scanning? (Protect > Web > General Settings)

Would it be possible to please share a screenshot of these settings (along with expanding the advanced settings tab).

Thanks,

Hi FloSupport

 Here is the screenshot :

The settings are the same on the 10 others XG I manage and the issue is happening only on the XG125.

Thank you for your help.

Hi Viken,

Thanks for following up.

For troubleshooting, could you try switching your scan engine to Avira and then re-enabling Scan HTTP on your firewall rule to test if the issue still occurs?

Regards,

Hi FloSupport 

Sorry I didn't mention it, but I already tried to switch the engine to Avira and then re-enabled Scan HTTP during 24 hours, but the problem was still the same at the next morning.

This is why I totally disabled Scan HTTP on the firewall rules.

Thank you

Regards,

Hello,

Just an update, I obtained a RMA replacement unit from Sophos Support to replace  the deffective XG125.

I will replace it soon and I hope it will resolve my issue.

Thank you for your help.

Hello,

does that replacement unit fixed your problem?

Or you found another solution?

Regards Philipp

Hello

I received the replacement unit, I reconfigured it, and i sent it back to the custommer, they did not receive it yet.

They should receive it today or tomorrow, then I could tell if the replacement unit resolved the problem.

Regards,

Hi VikenNajarian , have you fixed the issue replacing the unit?

Hi VikenNajarian , have you fixed the issue replacing the unit?

Hi PaulSof 

Yes the replacement of the unit fixed the issue.

Question anyway - even if the replacement solved your issue. Is there a reason, why you are using realtime scan instead of batch scan ?

Realtime scan is less capable for malware analysis than batch mode (where AV sees the whole file in one pice) and you also don't get block messages on malicious events, no sandboxing possible in realtime mode etc.. Even if this mode might lower delays at loading webpages/web content slightly, I personally never would recommend that setting and therefor disagree with Sophos KBA to that matter:

Sophos XG Firewall: What is Batch Mode and Real Mode in Malware Scanning?

(My personal) recommendation: Prefer batch in every scenario, unless you really get in performance troubles due web proxy av scanning laggyness, or if it's a uncritical network, where very basic pure signature AV capabilities are sufficient.

In every other case ==> Batch Scanning Mode

Hello,

100% of the Sophos XG units i'm managing (~25) are configured in Batch mode.

On the screenshot provided in this post, we can see realtime because it was for testing purpose, to test if the CPU was less used.

But once the replacement unit switched on, I set Batch mode back :)