Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 27 subscribers
  • Views 1000 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Garner Service Dead - XG V19.0 GA

Darrian Churchill

Hi all, I am running the latest version of Sophos XG (19.0) in a HyperV VM. All has been well since installation some time ago, but suddenly I am having issues with the Garner service, and the XG is reporting Service LoggingDaemon stopped. No config changes were made ahead of this issue.

When I check the status of the LoggingDaemon service via CLI it is reporting Dead. I tried starting Garner via the CLI and I get 503 failed. If I look at the service logs I see the below:

SFVH_HV01_SFOS 19.0.0 GA-Build317# tail -f /log/garner.log
CRITICAL  Jun 26 07:34:45Z [4151473216]: parse_conf_file: /cfs/system/logging/garner.conf - Transport endpoint is not connected
ERROR     Jun 26 07:34:45Z [4151473216]: garner: Parsing errors in file '/cfs/system/logging/garner.conf'.
MESSAGE   Jun 26 07:35:01Z [4152079424]: Starting garner-0.0.0.17 with glibc: 2.27 PID: (14779)
ERROR     Jun 26 07:35:01Z [4152079424]: fopen(/cfs/system/logging/garner.conf) failed: Transport endpoint is not connected
CRITICAL  Jun 26 07:35:01Z [4152079424]: parse_conf_file: /cfs/system/logging/garner.conf - Transport endpoint is not connected
ERROR     Jun 26 07:35:01Z [4152079424]: garner: Parsing errors in file '/cfs/system/logging/garner.conf'.
MESSAGE   Jun 26 07:35:16Z [4151653440]: Starting garner-0.0.0.17 with glibc: 2.27 PID: (17120)
ERROR     Jun 26 07:35:16Z [4151653440]: fopen(/cfs/system/logging/garner.conf) failed: Transport endpoint is not connected
CRITICAL  Jun 26 07:35:16Z [4151653440]: parse_conf_file: /cfs/system/logging/garner.conf - Transport endpoint is not connected
ERROR     Jun 26 07:35:16Z [4151653440]: garner: Parsing errors in file '/cfs/system/logging/garner.conf'.
MESSAGE   Jun 26 07:35:32Z [4151567424]: Starting garner-0.0.0.17 with glibc: 2.27 PID: (20809)
ERROR     Jun 26 07:35:32Z [4151567424]: fopen(/cfs/system/logging/garner.conf) failed: Transport endpoint is not connected
CRITICAL  Jun 26 07:35:32Z [4151567424]: parse_conf_file: /cfs/system/logging/garner.conf - Transport endpoint is not connected
ERROR     Jun 26 07:35:32Z [4151567424]: garner: Parsing errors in file '/cfs/system/logging/garner.conf'.

Has anyone else faced this issue on version 19.0? I have kind of hit a dead end fixing it. If I restart the appliance, sometimes Garner is running but not for long. It always ends up dead with the above issues.

All I can think to do is either reinstall and restore from a backup, or wait for an MR release for 19.0 to see if that resolves the issue.

Thanks in advance to anyone with more of a clue as to what I can do.



This thread was automatically locked due to age.
  • 0

    Hi,

    how big is your disk, have you run out of disk space?
    ian

  • 0 in reply to rfcat_vk

    The VM has the default disks - primary 16GB / auxiliary 80GB. Last I was able to check the graphs they were far from full, in fact under 25%. As one of my troubleshooting steps I purged all logs, so I can't see disk space being an issue, unless the primary 16GB is somehow full. I ran df -h and get the following:

    Filesystem                Size      Used Available Use% Mounted on
    none                    640.9M      6.7M    587.5M   1% /
    none                      1.9G     24.0K      1.9G   0% /dev
    none                      1.9G     24.2M      1.9G   1% /tmp
    none                      1.9G     14.6M      1.9G   1% /dev/shm
    /dev/boot               127.7M     33.9M     91.1M  27% /boot
    /dev/mapper/mountconf
                            560.3M     75.4M    480.9M  14% /conf
    /dev/content             11.8G    659.3M     11.2G   5% /content
    /dev/var                 70.7G     16.9G     53.8G  24% /var
    df: /cfs: Transport endpoint is not connected
    df: /cfs: Transport endpoint is not connected

    Intertsting that Transport endpoint error has shown up here too. Perhaps its an aux disk issue?


    Physically, the HyperV host stores VMs on a 480GB SSD, and it is nowhere near full.

  • 0 in reply to Darrian Churchill

    Hi,

    I assume this is a home installation so you will have to wait until experienced contributor reads the thread to add possible solutions.

    Ian