Network Usage not including Intrusion Prevention Exception

An interesting situation, Jay.  Show us a picture of the Edit of your Exception.  Is Application Control enabled?

Cheers - Bob

Bob,

Application control is disabled.  By design, should network usage indicate usage even for ips exceptions?

I don't know what the intended design is, Jay.  What happens if you delete the FTP service in that Exception?

Another thought, do all of the other graphs and reporting details indicate that there's no problem with a PostgreSQL database?

Cheers - Bob

I'm not sure how to check the PostgreSQL database.  All the graphs (including daily, weekly, monthly and bw usage) populate properly.  They just don't reflect data transferred using ftp.  If I disable the exception (no need to even delete) then bw usage is reflected accordingly... albeit at the price of scanning data that doesn't need to be scanned.

My thought was to have the exception apply to the server and not include the FTP service.

Cheers - Bob

There's other traffic on the server which should be monitored for so that solution wouldn't quite work.

The exclusion has been disabled/turned off for a few days.  I turned it back on little bit ago and transfered ~10 GB worth.  BW usage is reporting it now.  Very strange.  There's been days when upwards of 50GB was transferred and no indication of such transfers in bw usage.   We'll see how long this lasts for.

I just don't think I've seen a situation where skipping traffic for Snort resulted in Reporting not counting the traffic.

Cheers - Bob

Had another large transfer over night.  Network usage not reflecting again.  IPS exception for the service was enabled.

Any thoughts on how to troubleshoot?

Time to get Sophos Support involved.

Cheers - Bob

As someone with the home license, what channel of support is appropriate?