Yesterday I encountered a problem with the proxy server.
Every browser request got answered by an error notice
(see attachment : client_error.jpg), which resulted
in all users not being able to use internet services.

A little research showed me that the Memory and Swap
Usage were at a very high percentage (Mem:96.77% and
Swap:100.00%) (see attachment : monthly_stat.jpg).

Restarting the server was no option to resolve this problem
and I chose for the option of resetting (toggle off/on)
some services. I started with the Antivirus scanning
engine (see attachment : antivirus.jpg).

This immediately solved my problem and the high
memory usage of the server. A drop of 50% can be
seen in the montly_stat.jpg.

At this point the server is OK, but I have some worries
that this will be a recurring problem.

Sophos UTM 9 Server info
HP Proliant DL380 G8
RAM : 4GB
CPU : Intel Xeon Quadcore
Support : Standard Support
Version : Software

Question for all...is there any other place where I can
drop this information?

Attached Images

	client_error.JPG (27.1 KB, 4 views)
	monthly_stat.jpg (40.4 KB, 5 views)
	antivirus.jpg (80.0 KB, 4 views)

Hi MarcDekker

UTM 9 has some Memory Leaks (see here: 9-0044-33-spikes-high-cpu-memory-14)

The Fix is scheduled vor 9.005... BUT you should upgrade your Memory anyways... 4GB is minimum and the Bottleneck in your Hardware (asuming that you don´t use that kind of Server for only 5 Users...).

__________________
Astaro V9.1xx at Home - JetWay JNF99FL-525-LF / 4GB Ram / 160 GB Hdd / 5 x Intel NIC
Astaro V8.3xx at Work - 2x HP DL360G6 / 1 x QC 2,5Ghz / 12GB Ram / 146 GB Hdd / 2 x NC364T QP-Nic / HA

Agreed with KSeemann about upgrading to 8GB. Check the RAM bar in 'Resource usage' on the Dashboard to be sure that your UTM sees all of the RAM - if you did a 32-bit install, you'll want to re-install with 64-bit.

Prior to V9, the second AV engine was clamv. I never saw a single catch by that if Avira missed something (which I can't document that it did), so all of my installations use only a single AV engine.

In V9, the engines are Avira and Sophos - both excellent. Since the engine used in Sophos Endpoint is the Sophos engine, there's no reason to also run it on the UTM. I set the 'Single scan engine' to "Avira" on the 'Scan Settings' tab of 'System Settings' in the several installations I have of V9. This even for the sites that are not yet using Endpoint.

Cheers - Bob

__________________
ACE V7 - Astaro Preferred Partner since V3
Sophos Gold Solution Partner
www.MediaSoftUSA.com
Addicted to my iPhone!