Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 2 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 4703 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Firewall reported computer not sending heartbeat signals

Josh Rawse

Hi guys,

I'm desperate for some help. We have a Sophos XG which is kicking users off the network due to the PC not sending security heartbeats. The only way to resolve the issue is to reboot the endpoint. There's no consistency to the issue it happens to random users at random times. I've checked the heartbeat log on one of the clients and get the below.

2021-08-17T08:45:51.073Z [15512: 456] - Sending health status: {"admin":1, "health":1, "service":1, "threat":1}
2021-08-17T08:46:43.376Z [15512: 456] - Sending health status: {"health":3}
2021-08-17T08:46:51.240Z [15512: 456] - Sending health status: {"admin":1, "health":1, "service":1, "threat":1}
2021-08-17T08:47:43.396Z [15512: 456] - Sending health status: {"health":3}

Cheers,

Josh



This thread was automatically locked due to age.
  • 0

    is this the clients heartbeat log?

    check /log/heartbeatd.log on your firewall for that time and heartbeat ID.

    go to logviewer, select security heartbeat and filter the computername from the mail you received.

    today we had two occourrences here, the first looked to me like the computer changed from wired to wireless network or vice versa

    2021-08-17 11:04:05 WARN HBSessionHandler.cpp[23017]:123 findPinnedEndpointIdentity - session from endpoint rejected, because the endpoint ID already exists: b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx
2021-08-17 11:04:06 WARN HBSessionHandler.cpp[23017]:123 findPinnedEndpointIdentity - session from endpoint rejected, because the endpoint ID already exists: b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx
2021-08-17 11:04:07 WARN HBSessionHandler.cpp[23017]:123 findPinnedEndpointIdentity - session from endpoint rejected, because the endpoint ID already exists: b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx
2021-08-17 11:04:08 WARN HBSessionHandler.cpp[23017]:123 findPinnedEndpointIdentity - session from endpoint rejected, because the endpoint ID already exists: b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx
2021-08-17 11:04:10 WARN HBSessionHandler.cpp[23017]:123 findPinnedEndpointIdentity - session from endpoint rejected, because the endpoint ID already exists: b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx
2021-08-17 11:04:10 INFO EndpointStorage.cpp[23017]:114 endpoint_connectivity_cb - Connectivity changed for <b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx>: <1> -> <3>
2021-08-17 11:04:11 INFO EndpointStorage.cpp[23017]:114 endpoint_connectivity_cb - Connectivity changed for <b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx>: <3> -> <1>
2021-08-17 11:04:11 INFO EndpointStorage.cpp[23017]:132 endpoint_maclist_cb - Mac list gets replaced for uuid <b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx>
2021-08-17 11:04:11 INFO EpStateListBroker.cpp[23017]:56 markEndpointForUpdates - Endpoint marked for receiving Stonewall updates: b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx(192.168.52.96)
2021-08-17 11:04:13 WARN GarnerEventHandler.cpp[23017]:56 update - got missing heartbeat notification from garner for endpoint b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx which is not in lost state
2021-08-17 11:04:15 WARN GarnerEventHandler.cpp[23017]:56 update - got missing heartbeat notification from garner for endpoint b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx which is not in lost state
2021-08-17 11:04:17 WARN GarnerEventHandler.cpp[23017]:56 update - got missing heartbeat notification from garner for endpoint b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx which is not in lost state
2021-08-17 11:04:17 WARN GarnerEventHandler.cpp[23017]:56 update - got missing heartbeat notification from garner for endpoint b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx which is not in lost state
2021-08-17 11:04:18 WARN GarnerEventHandler.cpp[23017]:56 update - got missing heartbeat notification from garner for endpoint b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx which is not in lost state
...
2021-08-17 11:04:27 WARN GarnerEventHandler.cpp[23017]:56 update - got missing heartbeat notification from garner for endpoint b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx which is not in lost state
2021-08-17 11:04:45 INFO SacProcessor.cpp[23017]:64 discardApp - Sent switchOffConnectionInfo request to endpoint: <b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx>, Application path :C:\134program files (x86)\134microsoft\134edge\134application\134msedge.exe
2021-08-17 11:32:40 INFO EndpointStorage.cpp[23017]:114 endpoint_connectivity_cb - Connectivity changed for <b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx>: <1> -> <3>
2021-08-17 12:09:14 INFO EndpointStorage.cpp[23017]:165 endpoint_ip_cb - Ip address gets replaced for uuid <b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx>
2021-08-17 12:09:14 INFO EndpointStorage.cpp[23017]:149 endpoint_timestamp_cb - Missing hearbeat timestamp gets replaced for uuid <b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx>
2021-08-17 12:09:14 INFO EndpointStorage.cpp[23017]:114 endpoint_connectivity_cb - Connectivity changed for <b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx>: <3> -> <4>
2021-08-17 12:09:25 INFO EndpointStorage.cpp[23017]:114 endpoint_connectivity_cb - Connectivity changed for <b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx>: <4> -> <1>
2021-08-17 12:09:25 INFO EpStateListBroker.cpp[23017]:56 markEndpointForUpdates - Endpoint marked for receiving Stonewall updates: b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx(192.168.xxx.xxx)
2021-08-17 12:09:35 INFO ModuleStatus.cpp[23017]:138 processMessageStatus - Status request received from endpoint: b08b42d6-29f5-49c2-9cf2-xxxxxxxxxxxx (192.168.xxx.xxx) health: 1

    the second was when a client renewed it's IP

    2021-08-17 13:18:03 INFO EndpointStorage.cpp[23017]:165 endpoint_ip_cb - Ip address gets replaced for uuid <d67a499b-b1cc-4f9c-b023-xxxxxxxxxxxx>
2021-08-17 13:18:03 INFO EndpointStorage.cpp[23017]:149 endpoint_timestamp_cb - Missing hearbeat timestamp gets replaced for uuid <d67a499b-b1cc-4f9c-b023-xxxxxxxxxxxx>
2021-08-17 13:18:03 INFO EndpointStorage.cpp[23017]:114 endpoint_connectivity_cb - Connectivity changed for <d67a499b-b1cc-4f9c-b023-xxxxxxxxxxxx>: <3> -> <4>
2021-08-17 13:26:43 INFO EndpointStorage.cpp[23017]:114 endpoint_connectivity_cb - Connectivity changed for <d67a499b-b1cc-4f9c-b023-xxxxxxxxxxxx>: <4> -> <1>
2021-08-17 13:26:43 INFO EndpointStorage.cpp[23017]:132 endpoint_maclist_cb - Mac list gets replaced for uuid <d67a499b-b1cc-4f9c-b023-xxxxxxxxxxxx>
2021-08-17 13:26:43 INFO EpStateListBroker.cpp[23017]:56 markEndpointForUpdates - Endpoint marked for receiving Stonewall updates: d67a499b-b1cc-4f9c-b023-xxxxxxxxxxxx(192.168.xxx.xxx)
2021-08-17 13:26:48 INFO ModuleStatus.cpp[23017]:138 processMessageStatus - Status request received from endpoint: d67a499b-b1cc-4f9c-b023-xxxxxxxxxxxx (192.168.xxx.xxx) health: 3
2021-08-17 13:28:17 INFO EndpointStorage.cpp[23017]:114 endpoint_connectivity_cb - Connectivity changed for <d67a499b-b1cc-4f9c-b023-xxxxxxxxxxxx>: <1> -> <5>
2021-08-17 13:28:19 INFO EndpointStorage.cpp[23017]:114 endpoint_connectivity_cb - Connectivity changed for <d67a499b-b1cc-4f9c-b023-xxxxxxxxxxxx>: <5> -> <1>
2021-08-17 13:28:19 INFO EpStateListBroker.cpp[23017]:56 markEndpointForUpdates - Endpoint marked for receiving Stonewall updates: d67a499b-b1cc-4f9c-b023-xxxxxxxxxxxx(192.168.xxx.xxx)
2021-08-17 13:28:34 INFO ModuleStatus.cpp[23017]:138 processMessageStatus - Status request received from endpoint: d67a499b-b1cc-4f9c-b023-xxxxxxxxxxxx (192.168.xxx.xxx) health: 1
2021-08-17 13:53:27 INFO SacProcessor.cpp[23017]:64 discardApp - Sent switchOffConnectionInfo request to endpoint: <d67a499b-b1cc-4f9c-b023-xxxxxxxxxxxx>, Application path :C:\134program files (x86)\134microsoft\134edgeupdate\134microsoftedgeupdate.exe

  • 0

    Endpoints and Sophos Firewall communicate through an encrypted TLS connection over the IP address 52.5.76.173 on port 8347.

    Missing heartbeat

    Sophos Firewall logs a heartbeat as missing when it doesn’t receive three consecutive heartbeats from an endpoint that continues to send network traffic. When the endpoint sends the heartbeat again, Sophos Firewall considers it active. The MAC address of an endpoint determines a missing heartbeat, and all interfaces are taken into account.

    To avoid frequent and misleading notifications about endpoints going into a missing heartbeat status after intentional actions, such as include power off, suspend, hibernate, or moving to a different network adapter, you can customize the heartbeat detection behavior.

    • Increase the default timeout for missing heartbeat detection: The default timeout between the last received security heartbeat messages and moving the endpoint into a missing heartbeat status when still detecting network activity of the endpoint is set to 60 seconds. In some cases, when switching between network adapters, specifically when switching from a wired to a wireless connection, this timeout can be too short.
    • Delay sending Missing Heartbeat status to Sophos Central: By default, Sophos Firewall directly sends information to Sophos Central about an endpoint going into the missing heartbeat status. This results in Sophos Central sending an email notification about the missing heartbeat status.

    Set the behavior of heartbeat reports to Sophos Central.

    Syntax

    Description

    delay-missing-heartbeat-detection set NUMERICAL VALUE in seconds.

    Range: 30 to 285 in multiples of 15

    suppress-missing-heartbeat-to-central set NUMERICAL VALUE in seconds.

    Range: 0 to 120.

    Sets the time to wait before moving the endpoint to missing heartbeat status. Use this when there are frequent adapter changes (for example, when switching between Wi-Fi & LAN connections).

    Default: 60 seconds.

    Sets the time to wait before Sophos Firewall reports the missing heartbeat status to Sophos Central. We recommend using this option if endpoints are expected to frequently sleep, hibernate, shutdown, or wake up.

    Default: 0 seconds

    Note Using these options may delay missing heartbeat notifications that you want to receive.