Is it worth changing to an XG version?

Interesting discussion.

UTM9 was a Sophos device

XG is a Cyberoam device, rebranded

Fundamentally, UTM has been thrown in the rubbish bin and Sophos have moved to the Cyberoam OS / architecture. Firmware updates are re-introducing features that were in the UTM and these will continue, but fundamentally the XG is an entirely new OS from a different manufacturer that was bought out by Sophos.

Nit picking:   UTM is rebranded Astaro, which I have always understood to have been a corporate buy-out as well.

Given UTM's unique (odd) architecture, I can actually understand the product strategy.  

I can also understand their desire to free themselves from dependence upon, and licensing payments to, McAfee.

But to kill one product, you have to have a compelling alternative.

UTMs log data is almost sufficiently extensive, but it is difficult to use.   As confirmed by this discussion, XG's logging is awful, with content deficiencies, retention deficiencies, and user interface deficiencies.  IView is not a solution because it does not give visibility to the details.   If Sophos wants to sell XG into sophisticated accounts, they need to fix the logging.

Nit picking:   UTM is rebranded Astaro, which I have always understood to have been a corporate buy-out as well.

Given UTM's unique (odd) architecture, I can actually understand the product strategy.  

I can also understand their desire to free themselves from dependence upon, and licensing payments to, McAfee.

But to kill one product, you have to have a compelling alternative.

UTMs log data is almost sufficiently extensive, but it is difficult to use.   As confirmed by this discussion, XG's logging is awful, with content deficiencies, retention deficiencies, and user interface deficiencies.  IView is not a solution because it does not give visibility to the details.   If Sophos wants to sell XG into sophisticated accounts, they need to fix the logging.

Agreed on logging, this is a Cyberoam issue actually, and always has been.

In particular, the lack of detail on WHY an email is rejected/dropped is just plan embarassing.

You can find almost all of the same information in iView as you can on the device, the GUI is just ridiculous cumbersome and, lets be honest, you shouldn't have to install software just to view logs. I'm not sure you need logs longer than 2 weeks personally, but I understand that others may for their needs; the clearing of logs on reboot is terrible though. The bigger problem for me with logging is what is actually logs when it does log. A lot of the time the information is just useless.

A common problem I have is clients ringing up saying the internet is slow. Great. How do I drill down and find the issue? There's a live upload/download list in KB but realistically that tells me nothing other than being able to block that PC completely to resolve the issue.