Skip to content
The XG Series hardware appliances will reach end-of-life (EOL) on March 31, 2025. Click here to see the XG to XGS migration documentation.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/21.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=tools-troubleshooting-logs-report

Troubleshooting logs and CTR

You can download individual log files or generate a Consolidated troubleshooting report (CTR).

To download the log files or the CTR, go to Diagnostics > Tools.

Troubleshooting logs

You can download individual log files under Troubleshooting logs. See Download log files.

Consolidated troubleshooting report

You can generate a CTR and download all the log files and a system snapshot. The encrypted file includes the system's current status and log files with details, such as the active processes and resource usage. See Download log files.

CTR name format

You can generate a CTR and send it to Sophos Support to diagnose and troubleshoot an issue. The firewall generates the file with the following name format: CTR_<APPKEY>_<MM_DD_YY>_<HH_MM_SS>

  • APPKEY: Firewall's serial number.
  • MM_DD_YY: Date of report generation.
  • HH_MM_SS: Time of report generation.

Log lines in CTR

By default, the CTR includes 10,000 log lines for the service subsystem logs. You can lower this limit on the CLI. The log files and the number of lines they show in the CTR are as follows:

  • Default subsystems: These log files always include all the log lines.
  • Service subsystems: These log files are limited to the configured number of log lines.

To lower the CTR limit, sign in to the CLI, enter 4 for Device console, and enter the following command:

system diagnostics ctr-log-lines <number>

Note

The line limit in log files only applies to the CTR. You can get the complete log file from Troubleshooting logs and the CLI. See Log files for modules.

Debug-level logs

You can turn on debug mode for each subsystem to get debug-level logs. You'll get the detailed logs with Troubleshooting logs, CTR, and on the CLI.

Warning

To save disk space, we recommend that you turn off debug mode after you get the log files. See Check troubleshooting logs.

You can only turn on debug mode for the following subsystems.

Default logs Service logs
syslog.log awarrenhttp_access.log
postgres.log httplogd.log
reportdb.log bwm.log
applog.log awarrensmtp.log
access_server.log pktcapd.log
awarrenhttp.log warren.log
awed.log
charon.log
csc.log
garner.log
heartbeatd.log
ips.log
iview.log
msync.log
nSXLd.log
networkd.log
red.log
reverseproxy.log
smtpd_main.log
sslvpn.log
tomcat.log
u2d.log
up2date_av.log
npu-startup.log.prev
npu_syslog.log
syslog-ng.log
xgs-healthmond.log
xgs-host.log
xgs-npu-fw.log
xgs-pport-wait.log

More resources