This article applies to:

• R3000
• Web Filter 300/500/700
• WFR  350/550

Question:

Alert Email: The hourly health check detects "shadow.log pending"!

This alert email represents an urgent issue and customers should contact Trustwave Support ASAP.

Reply

If the Web Filter is sending you an alert email stating that there are shadow.logs pending, it means that traffic log transfers to your Security Reporter or external FTP server are failing, if you have a WFR or combo box where reporting is on the same hardware then call tech support now, some how the logs are not rotating to the reporter side.

Background: When a traffic log (shadow.log) transfer from the Filter fails, it keeps a copy of the log on its hard drive and attempts to send it again on the next log transfer session.  This will continue until the log is successfully transmitted.  Logs are transferred at the top of every hour.  If transfer failures continue to happen, the logs that fail to transfer will begin to build up, and this alert will be sent if 4 or more logs are failing to be sent. The filter will also show "failed" in Reporting>configuration>logs section.

Troubleshooting a stand alone Reporter: First verify if the reporter IP is responding to pings? if you ftp logs to a third-party-server verify if that server pings?

If the pings fail, please troubleshoot the reason why or call support, so we may log in and look.

There are a few possible causes for this error.  From the Web Filter GUI, go to the Reporting tab, and choose Report Configuration from the left.  Make sure that it is not trying to export to a device you do not have.  Also, verify that the addresses are correct in the settings for your export targets.  If everything looks ok, then click the "Log" tab and then the "View Log" button in order to see the FTP transfer logs.

If there are connection errors shown, then check your network connections to the export targets (Reporter or FTP server, which ever is appropriate), as well as the status of these target devices (Reporter or FTP server, whichever is appropriate).  If there are no visible error, but the PUT commands never seem to complete successfully, then the target device (Reporter or FTP server, whichever is appropriate) may be full.  If the full target device is an Enterprise Reporter, contact Technical Support in order to resolve the issue.