CM went off line for about 45 minutes - why?

Hi rfcat_vk : Any suspected logs or hint in centralmanagement.log, sophos-central.log around issue time..!!

I haven’t checked cm logs just my XG logs which showed fail to upload to cm only.

I will check cm logs shortly.

ian

Hi Vishal,

the CM logs basically show the same as the XG, failed to communicate, no more details.

The issue also occurred on the 21st June.

Ian

Hi Ian, 

Share the log output if you see any suspicious log entries for the time when it was failing to connect.

If no suspicious logs, then we need to monitor drop packet capture, tcpdump and the PCAP for the IP of CM.

You can get CM IPs by resolving the URLs found in the CM logs.

Hi Ian, 

Share the log output if you see any suspicious log entries for the time when it was failing to connect.

If no suspicious logs, then we need to monitor drop packet capture, tcpdump and the PCAP for the IP of CM.

You can get CM IPs by resolving the URLs found in the CM logs.

Hi,

but monitor for how long?

Ian

The answer might be one of the Devs was using my backup on a test system that accidentally connected to the internet?

ian

Hi Ian, 

It could be but how did you find out about the Failed attempts? Did you go through the logs or any firewall notification? 

Hi Devesh,

I received emails with strange details all referring to my XG by fqdn. I checked the XG and cm.

The details explain to me why my XG was showing offline a week or so ago with a strange IP address. I think Harsh and Emmanuel are investigating.

ian