Skip to content
The XG Series hardware appliances will reach end-of-life (EOL) on March 31, 2025. Click here to see the XG to XGS migration documentation.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=HA-logs-reports

HA logs and reports

Logs and reports aren't synchronized between the high availability devices. Each device contains logs and reports for the traffic it processes.

The auxiliary device sends report emails only for reports that contain data, such as those with email activity or pattern updates. It doesn't send emails for reports that don't contain data, such as the Security Dashboard or Security Audit reports.

You can see a combined report for both devices in Sophos Central Firewall reporting. See Logs & Reports.

Tip

In active-active HA mode, you can identify the device generating the logs based on the traffic's source IP address. The primary device processes traffic from even-numbered IP addresses. The auxiliary device processes traffic from odd-numbered IP addresses.

Event logs for HA

Log viewer shows the event logs. To see the logs, do as follows on each HA device:

  1. Click Log viewer in the upper-right corner of the web admin console.

  2. In the drop-down list, click System.

    Select the System module in Log viewer.

  3. Click Add filter and select a filter.

  4. Click the Add filter button.

    Here's an example of HA logs.

    Log entries in the log viewer.

Troubleshooting logs for HA

For the detailed troubleshooting logs, do as follows on each HA device:

  1. Go to Diagnostics > Tools.

  2. In the Troubleshooting logs section, click Select files and search for the following files:

    • csc.log: Central service, which manages all services
    • Additionally, see the logs listed in the following section High availability logs.

  3. Click Download.