gateways R55 stop sending log to NGx R65 CLM and stand-alone log server

[cciesec2006]

I have this issue and it has been driving me crazy for the past week or so.

I have a environment with a CMA NG with AI R55 with HFA_17 managing
about 20+ Secureplatform NG with AI R55 gateways with HFA_17. I also have
an Customer Log Module (CLM) residing inside a Multi-Log Module (MLM). In
addition to that, I also have stand-alone log server. Gateways send
log to both the CLM and the stand-alone log server. Everything is working
fine.

Two weeks ago, I migrated the CMA from NG with AI R55 to NGx R65 with
HFA_02 and hf_249. I also have a new Customer Log Module in NGx R65 as well.
On top of that, I also added a new stand-alone log server NGx R65.
Everything is Secureplatform. In other words, I have a new CLM, an old
R55 stand-alone log server and a new NGx R65 stand-alone log server.
In other words, my gateways are sending log to three different places:
new CLM, new stand-alone log server and old R55 stand-alone log server.
The gateways are still on NG with AI R55 with HFA_17.

For the past week, some of the gateways just stop sending logs to both the
new CLM and new NGx R65 stand-alone log server. The gateways NEVER stops
sending logs to the old R55 stand-alone server. The only way for me to fix
this is to reboot the gateways. After that, the gateway starts sending
log to the NGx CLM and stand-alone NGx R65 log server. A few days later,
it stops sending log again.

Anyone know what could be the issue? Thanks.

[th0i3]

Fortunately, I came across this issue before. This is a bug which is apparently fixed in R65 HFA02 (enforcement module). You need to turn on kernel debug for logging which you'll have to research. Look for this error.

sendLogs: Fatal error, Conn ID=64, La st Seq=2147483647, New Seq=-1492181850, Bad new Seq

It may be a different problem.

[msjouw]

We have similar problems with a R62 CMA and some R62 and R55 AI Gateways however this happens very rarely, something like once every 3 months.

[th0i3]

Yup, that is the exact symptom my customer is having.