WebProxy STOPPED, WINGc DEAD

Hi Guenter 

Please follow the below given steps.

Connecting to the advanced shell

1. To connect using SSH, you may use any SSH client to connect to port 22 of the SFOS device.
2. Select option 5 Device Management.
3. Select option 3 Advanced Shell.

Try to restart the service using below given command

service <service name>:start/restart/stop/debug –ds nosync

-------------------------------------------------------------------------------------------------------------------------

fsck-on-nextboot , please perform this as well

Check file system integrity of all the partitions. Turning ON this option forcefully checks the file system integrity on
next device reboot. By default, a check is OFF but whenever the device goes in failsafe due to following reasons, this check
is automatically turned ON:

• Unable to start Config/Report/Signature Database
• Unable to Apply migration
• Unable to find the deployment mode

fsck-on-nextboot[ off | on | show ]

Once the check is turned ON, on the boot, all the partitions will be checked. The check will be turned OFF again on
the next boot.

If the option is ON and the device boots up due following reasons, then file system check will not be enforced and
the option will be disabled after boot:

• Factory reset
• Flush Device Report

Hi,

On Advancedshell and

kill -9 <PID_of_awarrenhttp>

the Webproxy is still running.

But WINGc is DEAD because

SFVH_SO01_SFOS 18.0.0 GA-Build379.HF050620.1# tail -f WINGc.log
May 07 19:20:59.562641 [MSG] load_crinfo() FW Version: 'SF01V_SO01_18.0.0.379'
May 07 19:21:00.276963 [MSG] load_crinfo() Publickey: '8bd7595d-77cf-4afd-973c-541b84260b0c'
-----------------------------------------
-----------------------------------------
May 07 19:21:00.302593 [MSG] create_webcat_cache() tldcount: 278
May 07 19:21:00.326770 [MSG] create_webcat_cache() done!
May 07 19:21:00.326825 [MSG] tlv_init() wctlv on 4

May 07 19:21:00.326860 [ERR] init_tlv_client() connect failed: No such file or directory!
May 07 19:21:00.326889 [ERR] tlv_init() failed to init TLV client!

May 07 19:21:00.326907 [FAT] main(): starting tlv listner failed

there are some missing file or directory.

fsck-on-nextboot, this command is unknown.

Hi Guenter 

fsck-on-nextboot will execute from Device Console, please log in to SSH and Select Option 4. Device console and execute the command and restart the device.

Hi,

as I wrote. This command is unknown.

Sophos Firmware Version SFOS 18.0.0 GA-Build379.HF050620.1

console> fsck

console> fsck-o

console> fsck-on-ne

console> fsck-on-nextboot show
% Error: Unknown Parameter 'fsck-on-nextboot'
console> fsck-on-nextboot
% Error: Unknown Parameter 'fsck-on-nextboot'
console>

Update:

The command is

system fsck-on-nextboot on

I did it, and rebootet the firewall.

In Advanced Console

service -S shows me

skein                STOPPED
awarrenhttp          STARTING
WINGc                DEAD

In addition

• Classic Webproxy is not working (Page is not reachable)
• Virusscan with SSL/TLS Inspection (DPI) does not display Block-Pages
• SSL/TLS Inspection (DPI) does not display Block-Pages when Category is blocked.

 Update:

The Webinterface shows again

Currently these Services are stopped, or dead.

Hi Guenter 

Could you please check your license details? Please also share the service -S command output and when you try to start/restart the service what error message are you getting.

WINGc service was used for web categorization in the previous SFOS version from SFOS v17 it has been changed to nSXLd service - https://community.sophos.com/kb/en-us/132211

Seems OK

SFVH_SO01_SFOS 18.0.0 GA-Build379.HF050620.1# service -S
lcdd                 UNTOUCHED
postgres             RUNNING
sigdb                RUNNING
reportdb             RUNNING
awarrensmtp          UNREGISTERED
smtpd                RUNNING
nasm                 RUNNING
ntpclient            RUNNING
garner               RUNNING
skein                STOPPED
awarrenhttp          STARTING
WINGc                DEAD
nsxld                RUNNING
warren               RUNNING
ftpproxy             RUNNING
ctipd                RUNNING
antispam             RUNNING
ips                  RUNNING
ripd                 RUNNING
ospfd                RUNNING
bgpd                 RUNNING
zebra                RUNNING
dgd                  RUNNING
dhcpd                RUNNING
dhcpd6               UNREGISTERED
ipsec-monitor        RUNNING
strongswan           RUNNING
strongswan-ctl       UNTOUCHED
ddc                  RUNNING
networkd             RUNNING
dyniface             UNTOUCHED
gateway              RUNNING
tomcat               RUNNING
ssod                 UNTOUCHED
fwcm-updaterd        UNREGISTERED
fwcm-heartbeatd      UNREGISTERED
fwcm-eventd          UNREGISTERED
apache               RUNNING
antivirus            RUNNING
sandboxd             RUNNING
dnsd                 RUNNING
sslvpn               RUNNING
clientless_acce      RUNNING
pptpd                UNREGISTERED
l2tpd                RUNNING
mrouting             UNREGISTERED
pimd                 UNREGISTERED
ha_tunnel            UNTOUCHED
ha_pair              UNREGISTERED
msync                UNTOUCHED
WAF                  UNREGISTERED
red_client           UNREGISTERED
red                  UNREGISTERED
supportaccess        UNTOUCHED
heartbeat            UNREGISTERED
enhancedappctrl      UNREGISTERED
csd                  UNTOUCHED
access_server        RUNNING
bwm                  RUNNING
fwm                  UNTOUCHED
radvd                UNREGISTERED
fqdnd                RUNNING
fwlog                RUNNING
pktcapd              RUNNING
hostapd              UNTOUCHED
mdev                 UNREGISTERED
awed                 RUNNING
hotspotd             RUNNING
policyroute          RUNNING
snmpd                UNREGISTERED
redis-av             RUNNING
redis-modified-      RUNNING
redis-original-      RUNNING
redis-quota          RUNNING
redis-resume-se      RUNNING
redis-resume-ti      RUNNING
redis-appcache       RUNNING
link_notify          UNTOUCHED
appcached            RUNNING
vmtool               UNTOUCHED
cfs                  RUNNING
listener             RUNNING
timer                RUNNING
shm                  RUNNING
dbh                  RUNNING

License:

(Sensitive Infos deleted)

Device registration details
Model     SFVH (C----------)
Company name     --------------------
Contact person     Günter   
Registered email address     --------------
Module subscription

Add a subscription to your serial number or add time to your existing subscription.

Module subscription details
Module     Status     Expiration date
Base firewall     Evaluating     Tue 31 Dec 2999
Network protection     Evaluating     Tue 31 Dec 2999
Web protection     Evaluating     Tue 31 Dec 2999
Email protection     Evaluating     Tue 31 Dec 2999
Web server protection     Evaluating     Tue 31 Dec 2999
Sandstorm     Unsubscribed     -
Enhanced support     Evaluating     Tue 31 Dec 2999
Enhanced plus support     Unsubscribed     -

Hi Guenter 

Are you using XG home version?

Service status seems to be fine

Yes, this Setup runs a Home License.

Hi Guenter 

1. Sign to the XG Firewall's console.
2. Select option 4. Device Console.
3. Run the following command.
   console> system diagnostics show version-info

Please share the output of the command.

Hi,

Sophos Firmware Version SFOS 18.0.0 GA-Build379.HF050620.1

console> system diagnostics show version-info

Serial Number:                  C----------------
Device-Id:                      8bd7595d-77cf-4afd-973c-541b84260b0c
Appliance Model:                SFVH
Firmware Version:               SFOS 18.0.0 GA-Build379.HF050620.1
Firmware Build:                 379
Firmware Loader version:
HW version:                     SO01
Config DB version:              18.011
Signature DB version:           18.011
Report DB version:                18.011
Webcat Signature version:
Web Proxy version:              compiled
SMTP Proxy version:             1.0
POP/IMAP Proxy version:         1.0.0.3.4
Logging Daemon version:         0.0.0.17
AP Firmware:                    11.0.011
ATP:                            1.0.0296
Avira AV:                       1.0.407500
Authentication Clients:         1.0.0019
Geoip ip2country DB:            0
IPS and Application signatures: 18.17.07
Sophos Connect Clients:         1.4.001
RED Firmware:                   3.0.000
Sophos AV:                      1.0.15575
SSLVPN Clients:                 1.0.007
Hot Fix version:                5