SFVH (SFOS 18.0.4 MR-4) - no Reports

Hi Dean Andeselic,

Thank you for reaching out to Sophos Community.

Request to share output of below commands.

==> Login to SSH > 5. Device management > 3. Advanced Shell

# service -S | grep garner

# service -S | grep reportdb

# df -kh

# tail -n 100 garner.log

# tail -n 100 reportdb.log

==> Login to SSH > 4. Device Console

console> show on-box-reports

Hello Yash

SFVH_SO01_SFOS 18.0.4 MR-4# service -S | grep garner
garner RUNNING

SFVH_SO01_SFOS 18.0.4 MR-4# service -S | grep reportdb
reportdb RUNNING

SFVH_SO01_SFOS 18.0.4 MR-4# df -kh
Filesystem Size Used Available Use% Mounted on
none 235.6M 4.5M 214.7M 2% /
none 2.9G 12.0K 2.9G 0% /dev
none 2.9G 43.9M 2.9G 1% /tmp
none 2.9G 14.8M 2.9G 0% /dev/shm
/dev/boot 127.7M 64.0M 61.0M 51% /boot
/dev/mapper/mountconf
385.4M 78.0M 303.4M 20% /conf
/dev/content 2.6G 593.2M 2.0G 22% /content
/dev/var 21.8G 18.9G 2.9G 87% /var

SFVH_SO01_SFOS 18.0.4 MR-4# tail -n 100 garner.log
tail: can't open 'garner.log': No such file or directory
tail: no files

SFVH_SO01_SFOS 18.0.4 MR-4# tail -n 100 reportdb.log
tail: can't open 'reportdb.log': No such file or directory
tail: no files

console> show on-box-reports
Local Reporting : on

Thanks too,

Dean

Dean Andeselic said:

/dev/var 21.8G 18.9G 2.9G 87% /var

It seems the report partition has exceeded its watermark limit. You can run the below command to check the watermark limit.

console> show report-disk-usage watermark

Request to purge old reports by following the below article.

support.sophos.com/.../KB-000035779

As Yash mentions the log partition is too full. It gets very twitchy over 80% (why it can't auto prune the data at this point is a mystery to me, but perhaps the "Next Generation Logging" that's in the pipeline will sort that). You can manually purge the report data till you under the limit. I've had it work into the 90% but mostly once you hit 80% things break.

Regards

As Yash mentions the log partition is too full. It gets very twitchy over 80% (why it can't auto prune the data at this point is a mystery to me, but perhaps the "Next Generation Logging" that's in the pipeline will sort that). You can manually purge the report data till you under the limit. I've had it work into the 90% but mostly once you hit 80% things break.

Regards