Hello dear Community,
I have a problem with our SG430 HA (active/passive) system in my company.
As the title says already, if the logging & reporting services are enabled, the
CPU consumption shoots through the roof during our peak times in the morning and afternoon.
Serveral services stop to work(http,waf,smtp) for a few minutes multiple times a day.
Before someone asks, I already contacted our reseller with our problem too.
But I hope to get some non sales minded tips or answers in this case.
(...buy a bigger one without looking for solutions etc. doesn't help me here.....)
Especially if someone else is encountering any trouble with the logging & reporting in a similar manner.
Our settings for this section are as follows :
- 1 month for all reporting
- 1 level of URL detail
- IPFIX Accounting enabled
- daily, weekly and montly reports are enabled
- general logging is also enabled
I know that I could easily disable all the logging probes and be fine of course, but one of the key benefits of theses devices are these reporting features [:)]
Here is a briefly overview of our setup with some data:
- 9304-5 version used.
- 100MBit dynamic internet line
- about 1000 definitions & user objects
- 5 local networks with about 1000 clients / currently 600 alive
- 10 site-to-site tunnel
- 7 RED 10 devices connected
- 10-20 concurrent SSL-VPN users
- WebFiltering active with Dual-Scanning (512MB) + HTTPS, 200000 req/day
- FTPFiltering active with Dual-Scanning (512MB)
- SMTP-Proxy active with Dual-Scanning (512MB), 20000 mails/day
- Network Visibility active with 4 blocking groups
- Firewall with 64 rules, 109 NAT rules, one class C net outside
- 15000-20000 concurrent connections
- IPS deactivated
- ATP deactivated
- Endpoint deactivated
- Wireless Protection deactivated
- Sophos UTM Manager deactivated
- Sophos Mobile Control deactivated
- POP3 Proxy deactivated
Is this already too much for this device? Or are there any open issues with log&report that
I didn't found so far?
I periodically look in the known issues list for hints to existing problems I may have but....nothing found so far that helps.
Maybe someone is willing to tell me about his experience in a similar case?
Thanks in advance.
Junkz
This thread was automatically locked due to age.
