Sophos randomly reboot (XG330)

Hello there,

Thank you for contacting the Sophos Community.

The hotfix does not reboot the firewall. What Firmware version are you running? 

Regards,

Im running this firmware (SFOS 18.5.2 MR-2-Build380)

Hi Gino Ouellet 

Do you see anything in the following logs;

csc.log, applog.log, syslog.log, msync.log and networkd.log, memory and CPU graph?

Would it be possible for you to save the console logging?

You will need a direct console/serial connection to the device: 

Note: Be sure that the computer in question does not go into Standby or Hibernate while logging.

Did you notice any spike in CPU usage or High Traffic generated from LAN?

You may use the article to verify the system graphs - https://community.sophos.com/kb/en-us/123186

Please disable SSH access for the WAN zone.

Please check the system and admin events from the log viewer for suspicious activity.

fsck-on-nextboot from Sophos XG SSH CLI console

Check the file system integrity of all the partitions. Turning ON this option forcefully checks the file system integrity on the next device reboot. By default, check is OFF but whenever device goes in failsafe due to following reasons, this check is automatically turned ON: • Unable to start Config/Report/Signature Database • Unable to Apply migration • Unable to find the deployment mode fsck-on-nextboot[ off | on | show ] Once the check is turned ON, on the boot, all the partitions will be checked. The check will be turned OFF again on the next boot. 

Using PuTTY, go to 'Session' - 'Logging.'
Here, select "All session output', and set the file name to a folder and name for later retrieval.
Configure the Serial connection to use the proper COM port on your PC and a Speed of 38400.
Start the session, and log in to ensure it is all proper.
Once logged in, you can leave it there or log out and leave the session at the password prompt. Either way, leave the session active and allow it to capture the output from the next reboot.
Once that reboot occurs, you can end the Serial connection and provide the logs to support further investigation.

Regards,

Sorry for the late reply. I found other discussion of random reboot, other people say they disable (firewall-acceleration). So i did this and it seem to work for now.

Thanks for the update, XG330 is the HA cluster or a single unit?

Have you checked with SFOS 18.5.4 MR-4-Build418 firmware version? share the status showing under System-->Backup&Firmware-->Firmware

Regards

Thanks for the update, XG330 is the HA cluster or a single unit?

Have you checked with SFOS 18.5.4 MR-4-Build418 firmware version? share the status showing under System-->Backup&Firmware-->Firmware

Regards

Single unit, and i do the upgrade im running on (SFOS 18.5.4 MR-4-Build418). 4 days after the upgrade the firewall reboot randomly again. Right now im running for 5 consecutive days with firewall-acceleration disable (11 consecutive days is the best before a random reboot)

Try to Collect the logs to find the root causing the issue with firewall acceleration enable and disable and share the logs to Sophos Support team over a ticket for further investigation with Access ID.

https://support.sophos.com/support/s/article/KB-000041274?language=en_US 

Regards