topic Re: I'm getting an unusual message like'ips_gen_dyn_log: malware_policy_global_send_log() failed'. in General Topics

I'm getting an unusual message like'ips_gen_dyn_log: malware_policy_global_send_log() failed'.

ChoiYunSoo — Fri, 08 Jan 2021 08:47:40 GMT

Hello nice to meet you

Recently, a customer's firewall has lost its service connection due to an increase in resources for an unknown reason.

And I don't know if it is related to resource increase or service disconnection, but the message below will be generated every time there is an issue.

I saw something similar to this in 'sk167939', but the customer is a completely different version from the DB version specified in sk.

In addition, TAC said that there are no bugs in DB versions other than those specified in SK.

I am wondering if that message has anything to do with increasing resource usage.

Symptoms and messages are the same for the two devices specified below.

* Model: SG23800

* Version: R80.40 (VRRP)

* Blade: Firewall / IPS

* CPU: 48Core (H/T on)

* Memory: 32G

* Model: SG15600

* Version: R80.10 (VRRP)

* Blade: Firewall / IPS

* CPU: 32 Core(H/T on)

* Memory: 16G

Jan 7 07:45:03 2021 LGESA_GW_FW1 kernel: [fw4_1];CLUS-120202-1: Stopping CUL mode after 11 sec (short CUL timeout), because no member reported CPU usage above the configured threshold (80%) during the last 10 sec.
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_1];CLUS-120200-1: Starting CUL mode because CPU-04 usage (84%) on the local member increased above the configured threshold (80%).
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_39];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_14];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_13];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_4];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_8];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_0];fwmultik_prio_handle_gconn_lookup: failed getting instance section from connection 40.90.4.201(53) -> 156.147.135.180(52007) IPP 17 instance 29
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_0];fwmultik_enqueue_data_kernel: error in gconn lock and lookup. cannot enqueue to priority queues. (instance 29, opcode:6)
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_32];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_39];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_2];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_17];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_8];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_9];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_14];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 last message repeated 2 times
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: [fw4_1];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 7 07:47:18 2021 LGESA_GW_FW1 kernel: FW-1: lost 2107 debug messages

PS This is the status information of the customer firewall at the time of the failure.

1. From 07:44 to 07:47, cpview data did not accumulate for about 3 minutes.

2. The cpu and memory usage of 47 minutes is very high compared to 44 minutes.

3. At that time, aggressive aging was activated.

Re: I'm getting an unusual message like'ips_gen_dyn_log: malware_policy_global_send_log() failed'.

_Val_ — Fri, 08 Jan 2021 09:22:57 GMT

This is your second post for the matter. Update your IPS and push policy. If the issue remains, please raise a case with TAC

Re: I'm getting an unusual message like'ips_gen_dyn_log: malware_policy_global_send_log() failed'.

ChoiYunSoo — Mon, 11 Jan 2021 04:20:22 GMT

In accordance with the recommendations of TAC and SK, the IPS DB has been updated to the latest.

However, the problem continues to occur intermittently.

I need to know Whether the occurrence of that message is affecting the rise of firewall resources.

I opened a case to the TAC and it took more than a month, but the TAC is no sense of cause of this problem.

Re: I'm getting an unusual message like'ips_gen_dyn_log: malware_policy_global_send_log() failed'.

Chris_Atkinson — Mon, 11 Jan 2021 08:42:01 GMT

Presumably you've shared more detail with TAC as it's difficult to assist without knowing things such as installed JHF levels etc.

Re: I'm getting an unusual message like'ips_gen_dyn_log: malware_policy_global_send_log() failed'.

ChoiYunSoo — Tue, 12 Jan 2021 01:16:21 GMT

OS Version: R80.40

Hotfix: Take 89

OS Version: R80.10

Hotfix: Take 279

The same symptom is seen on both firewalls.

I don't know what trigger to increase cpu and memory at that time.

Re: I'm getting an unusual message like'ips_gen_dyn_log: malware_policy_global_send_log() failed'.

constant69 — Thu, 28 Jan 2021 13:10:54 GMT

Hi ChoiYunSoo,

I have the same log

-------------------------

Jan 19 14:52:41 2021 FIREWALLXXX01 kernel: [fw4_0];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 19 14:53:39 2021 FIREWALLXXX01 kernel: [fw4_0];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 19 14:55:11 2021 FIREWALLXXX01 kernel: [fw4_4];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 19 14:55:21 2021 FIREWALLXXX01 kernel: [fw4_0];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 19 14:55:27 2021 FIREWALLXXX01 kernel: [fw4_5];ips_gen_dyn_log: malware_policy_global_send_log() failed
Jan 19 14:56:04 2021 FIREWALLXXX01 kernel: [fw4_1];ips_gen_dyn_log: malware_policy_global_send_log() failed

-------------------------

What is the status of your case with the TAC ?

Thanks