After FW update 9.705: "urid not running - restarted"

That meant they were both successful, Tom.  Are you still seeing the "Categorization failed" message?  If so, you will want to get a case open with Sophos Support.  Please let us know what they did to address this.

Cheers - Bob

The errors are sporadic throughout the day. I will keep an eye on the logs and report back.

If you look at my posts with Emmanuel (EmmoSophos) farther up in this thread, you will see that he believes that SSD is failing. While that may be true, it's odd to me that the errors started immediately after the 9.705-3 update. Until you answered just now, I was considering a factory reset just for giggles.

I'll let you know.

Hello Tom,

You could also try to re-image the device! Hopefully, if it was something that corrupted the entries this should be solved there!

Regards,

You're referring to re-imaging with an ISO? I can try that but not until Saturday. In the mean time I'll see what Bob's suggestion does with the logs and I'll report back.

Thanks again!

Hello Tom,

Sorry yes, I should have been more clear, yes re-image using ISO. This is the URL to download the ISO.

https://www.sophos.com/en-us/support/utm-downloads.aspx

This is the KB that explains how to re-image the device, in case you are not familiar with the procedure.

Regards,

Thanks, I'm very familiar with the process. It won't be a problem.

Factory Reset wouldn't help, Tom - possibly re-imaging and restoring a backup if the drive isn't damaged.  If the SSD is suspect, and you know how to use it e2fsck might be able to save the disk.  Again, good luck and let us know.

Cheers - Bob

The UTM was reimaged on Saturday without issue and monitored throughout the weekend. Between that and a full day of user traffic today, all logs are clean and not showing the I/O errors. The URID email have also stopped. Hopefully, the cause of this was a bad firmware update install.

Thank you Emmanuel and Bob for your attention to this!

Tom