Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 26 replies
  • Answers 2 answers
  • Subscribers 29 subscribers
  • Views 6940 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS service has stopped and will not restart.

rfcat_vk

Hi folks,

v19.0.1 MR-1 IPS service has stopped and will not restart, the error message is the process is taking too long.

There are no entries in the Logviewer -> system log indicating any issues.

Next step please.

Update :- after two attempts the GUI shows the service as restarting. There are no entries in log viewer -> IPS.

Ian

Memory has dropped from 80+% to 66%, CPU has increased

10am yesterday I restarted a 8 port switch to see if that would fix an IPv6 issue which it did, but the memory use dropped significantly. I also changed the maximum network packet size on one LAN interface which took all interfaces off line for a short time another bug.



This thread was automatically locked due to age.
  • 0 in reply to Vivek Jagad

    Hi Vivek,

    Thank you for running the new script. I see that the IPS pattern has updated, but still shows failed. The IPS service shows dead. None of the firmware has updated since I ran the script last night. I have changed the update schedule to 12 hours.

    I initiated a firmware update, downloaded and failed.

    Ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Rachel Gomez

    Another irrelevant answer, please delete or I will.

    ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hey ,

    I found under the ips.log:
    modprobe: can't load module nfnetmap_queue (extra/nfnetmap_queue.ko): Cannot allocate memory
    2022-08-15T23:23:12.398023Z [17824] '/scripts/firewall/manage_slowpath.sh reload 4': exited, status=1
    2022-08-15T23:23:12.398052Z [17824] configure spdaq failed
    2022-08-15T23:23:12.398109Z [17824] IPS: Master process is going down
    ========================
    I would also suggest once you please raise a service request with the sophos support !!

    Thanks & Regards,
    _______________________________________________________________

    Vivek Jagad | Team Lead, Global Support & Services 


    Sophos Community | Product Documentation | Sophos Techvids | SMS
    If a post solves your question please use the 'Verify Answer' button.

  • 0

    Can you please install Build 365 and report back, if the issue is resolved? 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Hi Lucar Toni,

    I have installed the latest release and waited until all the firmware updates were completed except for the ips which failed. I powered down the XG and powered it on, tried restarting the ips service and it still shows failed. The ips firmware when last reviewed was still downloading.

    All the other firmware updated.

    ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    I will try down grading the interface mtu and see if that fixes the issue.

    ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Can you send me the Support Access ID? 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Hi,

    in a pm to you.

    ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hi rfcat_vk, 

    We looked into your device, and IPS could not start because it could not allocate enough memory for buffers. The higher the MTU value, the more memory IPS requires. This explains why when you lowered the MTU value again, IPS recovered. 

    Is there a reason why you need to set a high MTU value? 

    Note: This is unrelated to the ATP update issue for IPS in the original MR1 release, and this is also not a new behaviour in v19.0 MR1. 

Unfiltered HTML