Sophos Firewall: v19.0 MR1: Feedback and experiences

It seems to be using a lot less RAM. Been running 3.5 hours and averaging 67% RAM usage. Usage goes up over time, so it may settle in at a higher average, but v18.5 was using about 75% on average and v19 GA was using about 80% on average, for me.

Had a crash of v19 GA this afternoon where the blue (storage) light blinks like crazy and I slowly lose capabilities until the AP goes orange, etc and have to reboot. (This has happened maybe once a month for me, maybe once every two months.) Hopefully fixed in v19 MR1.

Just checked my machine. Before upgrading memory was stable around 70%, since the upgrade it climbed to now being 78%

I'll keep monitoring this.

Could you please send us a Screenshot of the webadmin and the memory consumption? 

Also check via atop on the CLI, which process is consuming so much memory. 

It looks like there was a sudden jump in memory usage. top is showing snort processes consuming the most currently.

Does any of those time values match with the sudden increase of the RAM? 

You see the run time and the increase seems to be some hours ago. Which process matches? 

Looking at the memory usage graph, it appears the increase in memory was at 3:34 AM local time. It was around 9:00 AM local time when I looked at top, so about 5 hours and 30 minutes from the increase in memory usage. It looks like it was an increase of 1,437 MB and I none of the times in top seem to correspond to an increase around that time (just looking at what appears to be the uptime for each process in top). 

I’ll keep letting it run for now to see what happens but I’ll reboot at some point if nothing changes and try to get some before and after screenshots.

Hello shred,

I have exactly the same experience on my virtual app. For a long time, the RAM memory is at about 50%, but now it is at 89%. But according to the RAM load graph, the spike didn't come until midday today. Probably a bad snort engine update?

Regards

alda

Ah that’s a good point on updates. Looking at mine, it looks like my IPS signatures haven’t been updated since 28 Jul but my AV and ATP was updated at 03:29:01, Aug 01 2022 which corresponds closely to the big jump in memory usage.

You can give me a Support Access ID and i will forward this for further inspection. 

Sent you a message with the Access ID. Also, I can see my memory use has increased to 91% and checking top, it’s definitely the snort processes increasing in memory usage.

Avira and ATP came through at the same time and memory use has grown.

Ian

Just to wrap up: 

NC-100681

Increase in snort memory with ATP pattern updates

Just to wrap up: 

NC-100681

Increase in snort memory with ATP pattern updates

I had a massive drop in memory usage (51% now) which appears to have occurred on 2 Aug at 15:37. The only pattern update around that time was the IPS and Application signatures at 15:30:20, Aug 02 2022. 

Thank you very much for flagging this shred. 

We have identified an issue with ATP data update in MR1. The issue causes more memory to be consumed by IPS after the update, and the memory is not freed until an IPS sig update subsequently occurs. Last ATP data update was Monday Aug 1, which is when you saw the spike in memory. An IPS update was then done on Aug 2, which is why you saw memory usage drop back down. 

We are now tracking this as a bug, and we're looking to release a new MR1 build with this fixed.  

Hello team!

I'm having problems with high memory consumption too. Model SG310 in version (SFOs 19.0.1 MR-1-Build365.

In a matter of 15 days, consumption rises from 40% to 80%.

I already have a ticket open with support and under review by global escalation specialists (GES).

Does this problem still occur for you? or was it actually fixed in the MR-1 version? For me the upgrade to MR-1 didn't solve the memory problem.