Sophos Community
Sophos Community
  • User
  • Site
  • Search
  • User
  • Community & Product Forums
  • Blogs
  • Partners
  • Events & Webinars
  • Getting Started
  • Support Portal
  • Community Blogs
    • Application Control
    • Community
    • Product documentation
    • Security
  • Feedback
    • Support Portal
    • Product documentation
  • Products
    • Endpoint security
      • Sophos Endpoint
      • Sophos XDR
      • Device Encryption
      • Sophos Mobile
    • Network Security
      • Sophos Firewall
      • Sophos ZTNA
      • Sophos Switch
      • UTM Firewall
      • Sophos Wireless
      • Sophos NDR
    • Email Security
      • Sophos Email
      • Phish Threat
    • Cloud Security
      • Sophos Central
      • Sophos Cloud Optix
    • Support Tools
      • Sophos integrations
      • Free tools
    • AI Solutions
      • Sophos AI
  • Services
    • Management platform
      • Sophos Professional Services
      • Sophos Central
      • Support Portal
      • Sophos Community log in
  • Sophos Partners
    • Partners blog
    • Local Partner community
    • Partner news
  • Resources
    • MSP guides
    • Partner Care
    • Sophos Central
  • Webinars & Events
    • Webinars & Events
    • Calendar
  • Become a partner
    • Join our program
  • Events & Webinars
    • Events & Webinars
    • Calendar
    • Recordings
  • Getting started in the Community
    • How to get started
    • SophosID registration
    • How to set up your profile
    • How to contribute and participate
    • How to manage private messages
  • Member recognition
    • Recognition program
    • Leaderboard
  • Products and Services
    • Products
      • Endpoint security
        • Sophos Endpoint
        • Sophos XDR
        • Device Encryption
        • Sophos Mobile
      • Network Security
        • Sophos Firewall
        • ZTNA
        • Sophos Switch
        • UTM Firewall
        • Sophos Wireless
        • NDR
      • Email Security
        • Sophos Email
        • Phish Threat
      • Cloud Security
        • Sophos Central
        • Sophos Cloud Optix
      • Support Tools
        • Sophos integrations
        • Free tools
      • AI Solutions
        • Sophos AI
    • Services
      • Management platform
        • Sophos Professional Services
        • Sophos Central
        • Support Portal
        • Sophos Community log in
  • Blogs
    • Community Blogs
      • Application Control
      • Community
      • Product documentation
      • Security
    • Feedback
      • Support Portal
      • Product documentation
  • Partners
    • Sophos Partners
      • Partners blog
      • Local Partner community
      • Partner news
    • Resources
      • MSP guides
      • Partner Care
      • Sophos Central
    • Webinars & Events
      • Webinars & Events
      • Calendar
    • Become a partner
      • Join our program
  • Events & Webinars
    • Events & Webinars
      • Events & Webinars
      • Calendar
      • Recordings
  • Getting Started
    • Getting started in the Community
      • How to get started
      • SophosID registration
      • How to set up your profile
      • How to contribute and participate
      • How to manage private messages
    • Member recognition
      • Recognition program
      • Leaderboard
  • Support Portal
Sophos Firewall
Sophos Firewall
Discussions How to find cause of strange reboots?
  • Release Notes & News
  • Discussions
  • Recommended Reads
  • Early Access Programs
  • More
  • Cancel
  • New
Sophos Firewall requires membership for participation - click to join
Thread Info
  • State Suggested Answer
  • +3 person also asked this people also asked this
  • Locked Locked
  • Replies 20 replies
  • Answers 2 answers
  • Subscribers 34 subscribers
  • Views 37255 views
  • Users 0 members are here
  • reports
  • syslog reporting
  • log viewer
  • syslog
  • log
  • logging
Options
  • RSS
  • More
  • Cancel
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to find cause of strange reboots?

Brad Shannon
Brad Shannon over 7 years ago

Hi folks, appreciate your help in advance.

 

I have an XG85 running SFOS 17.0.2 MR-2.

It is set up to send logs to a Syslog server I set up just yesterday. [https://i.imgur.com/BoNeNsB.png] [https://i.imgur.com/0h1MnvD.png]

That server is receiving some logs. [https://imgur.com/TRA2qDl]

 

Twice in the last 48 hours, the device has rebooted itself during times of high usage. What log settings should I configure to see what could be causing this, in case it happens again?

 

(Also, maybe it's related to SFOS 17?)

 

2/27/18 UPDATE:

  • updated to 17.0.5, same reboot problem.
  • replaced the hardware, restored settings to replacement, same reboot problem.
  • tried factory reset and manually re-entering the settings, same reboot problem.

I have a replacement non-Sophos FW en route. However, I got some interesting data from the COM port just now, which I'll add as a new reply below.



This thread was automatically locked due to age.
  • Cancel
  • RobertDavis
    0 RobertDavis over 7 years ago in reply to Brad Shannon

    I have had 2 random reboots since moving to v17.  I have also had a problem with /tmp filling up but I caught a reboot when /tmp was still small so that isn't causing the reboots.

    v15 and v16 was running great.

    The 105 still only has 2GB memory like the 85.  It just has a bigger drive and slightly faster clock speed CPU.

    • Cancel
    • Vote Up 0 Vote Down
    • Cancel
  • FloSupport
    +1 FloSupport over 7 years ago

    To update this thread for other users experiencing this similar issue on their XG85 appliance:

    Please reference this advisory KBA.

    Regards,

    • Cancel
    • Vote Up 0 Vote Down
    • Cancel
  • MiroslavCacija
    0 MiroslavCacija over 7 years ago in reply to FloSupport

    Just FYI after applying KB, things are even WORSE ... multiple disconnects, services failing, device unresponsive. I just cannot believe that Sophos cannot solve this problems for so long ... very bad situation for reputation.

    • Cancel
    • Vote Up 0 Vote Down
    • Cancel
  • Brad Shannon
    0 Brad Shannon over 7 years ago in reply to MiroslavCacija

    I gave up and bought a Ubiquiti USG

    • Cancel
    • Vote Up 0 Vote Down
    • Cancel
  • MiroslavCacija
    0 MiroslavCacija over 7 years ago in reply to Brad Shannon

    Ubiquiti is great, but it don't have near the security features as Sophos XG ... on the other hand XG is filled with bugs, and 85 up to 125 are so slooooooooow and underpowered hardware... I don't know ... bad situation, very bad.

    • Cancel
    • Vote Up 0 Vote Down
    • Cancel
  • Brad Shannon
    0 Brad Shannon over 7 years ago in reply to MiroslavCacija

    Agreed. In my case, this entire issue has left me with such a bad impression of Sophos that I can't justify upgrading to 125+ hardware.

    • Cancel
    • Vote Up 0 Vote Down
    • Cancel
  • FloSupport
    0 FloSupport over 7 years ago in reply to MiroslavCacija

    Hey MiroslavCacija 

    I'm sorry to hear about your continued issues with your XG85 device. Have you followed up with your initial support case to inform this update? Please also PM me with your support case number so that I can follow up.

    Thanks,

    • Cancel
    • Vote Up 0 Vote Down
    • Cancel
  • MiroslavCacija
    0 MiroslavCacija over 7 years ago in reply to FloSupport

    Possible solution for the XG 85 problem I see in migrating to UTM9, and I WILL migrate to UTM9, which is obviously far more stable product, to save my reputation with my clients. Never had anything similar with UTM9.

    Migration info:

    www.sophos.com/.../Conversion-Guide---Sophos-XG-Firewall-Appliance-to-Sophos-UTM.pdf

    • Cancel
    • Vote Up 0 Vote Down
    • Cancel
  • rdebraga
    0 rdebraga over 7 years ago in reply to Brad Shannon

    Hello Brad Shannon 

    could you plese tell me witch command dir you run to see this log 

     

    thaks 

    • Cancel
    • Vote Up 0 Vote Down
    • Cancel
  • Brad Shannon
    0 Brad Shannon over 7 years ago in reply to rdebraga

    No command -- the device sends those messages to the console automatically. I just happened to have a console window up, to see it.

    I connected the CONSOLE port of the Sophos to my computer's serial port. Then I used PuTTY to open a console session using the serial port's COM #.

     

    i.imgur.com/Yh0eRlY.png

    • Cancel
    • Vote Up 0 Vote Down
    • Cancel
<

Defeat Cyberattacks

Footer - Default

  • Column 1
    • Endpoint Security
      • Sophos Endpoint
      • Sophos XDR
      • Device Encryption
      • Sophos Mobile
    • Email Security
      • Sophos Email
      • Phish Threat
    • Support Tools
      • Sophos integrations
      • Free tools
  • Column 2
    • Network Security
      • Sophos Firewall
      • Sophos ZTNA
      • Sophos Switch
      • UTM Firewall
      • Sophos Wireless
      • Sophos NDR
    • Cloud Security
      • Sophos Central
      • Sophos Cloud Optix
  • Column 3
    • Partners
      • Find a partner
      • Managed service providers
      • Join our program
    • Current Partners
      • Partners blog
      • Local Partner Community blog
      • Partner MSG guides
      • Partner news
      • Partner care
      • Partner portal login
      • Training & certification
    • Management Platform
      • Sophos Central
  • Column 4
    • Support
      • Downloads and updates
      • Support packages
      • Support portal
      • Sophos Customer Success
      • Sophos Techvids
      • Sophos Learning Center
      • Sophos status
      • Tech support
    • Learn
      • Threat intelligence
      • X-Ops threat research
      • Trust center
      • Security blogs
      • Sophos Academy
  • Column 5
    • Getting Started
      • How to get started
      • Community FAQs
    • Member Recognition
      • Recognition program
      • Leaderboard
    • Events & Webinars
      • Webinars
      • Calendar
      • Recordings
  • Column 6
    • Try for Free
      • Free trials
      • Product demos
    • Sophos Home Premium
      • Sophos Home support
      • Contact Home support
      • Mac antivirus download
      • PC antivirus download
    • About Us
      • Company
      • Events
      • Press
      • Careers
  • Getting Started
  • Terms
  • Privacy
    • Privacy Notice
    • Cookies
  • Legal
    • General
    • Modern Slavery Statement
    • Speak Out
© 1997- Sophos Ltd. All Rights Reserved.