=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2020.09.23 11:11:50 =~=~=~=~=~=~=~=~=~=~=~=
ocessing HUP signal
Sep 23 16:11:12 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Accepting a service connection..
Sep 23 16:11:12 localhost SF-IMS[26192]: [26234] sftunneld:control_services [INFO] Successfully Send Interfaces info to peer 10.252.253.220 over br1
Sep 23 16:11:12 localhost SF-IMS[26192]: [26234] sftunneld:sf_heartbeat [INFO] IP(NTP) Service is published for peer 10.252.253.220.
Sep 23 16:11:12 localhost SF-IMS[26192]: [26234] sftunneld:sf_peers [INFO] Using a 750 entry queue for 10.252.253.220 - 8400
Sep 23 16:11:12 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] Loading DE configuration for service = 9101
Sep 23 16:11:12 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] Loading file processing config for service 9101
Sep 23 16:11:12 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] Loading VPN User config for service 9101
Sep 23 16:11:12 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] No VPN user config found
Sep 23 16:11:12 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] Ready for events type 10 with 5 instances
Sep 23 16:11:12 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] Ready for events type 17 with 2 instances
Sep 23 16:11:12 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] Ready for events type 12 with 2 instances
Sep 23 16:11:12 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] Ready for events type 11 with 2 instances
Sep 23 16:11:12 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] Ready for events type 1 with 2 instances
Sep 23 16:11:12 localhost SF-IMS[26192]: [26882] sftunneld:UEChannel [INFO] Loading DE configuration for service = 9100
Sep 23 16:11:12 localhost SF-IMS[26192]: [26882] sftunneld:UEChannel [INFO] Loading file processing config for service 9100
Sep 23 16:11:12 localhost SF-IMS[26192]: [26882] sftunneld:UEChannel [INFO] Loading VPN User config for service 9100
Sep 23 16:11:12 localhost SF-IMS[26192]: [26882] sftunneld:UEChannel [INFO] No VPN user config found
Sep 23 16:11:12 localhost SF-IMS[26192]: [26882] sftunneld:UEChannel [INFO] Ready for events type 16 with 2 instances
Sep 23 16:11:12 localhost SF-IMS[26192]: [26882] sftunneld:UEChannel [INFO] Ready for events type 15 with 2 instances
Sep 23 16:11:12 localhost SF-IMS[26194]: [26196] sfmbservice:sfmb_service [INFO] Start getting MB messages for 10.252.253.220
Sep 23 16:11:12 localhost SF-IMS[26194]: [26196] sfmbservice:sfmb_service [INFO] Established connection to peer 10.252.253.220
Sep 23 16:11:12 localhost SF-IMS[26194]: [26196] sfmbservice:sfmb_service [INFO] SFMB service: create unix socket '/ngfw/var/sf/peers/e2a0aed0-3108-11e5-966a-af6d2198b5cc/sfmb.sox'
Sep 23 16:11:12 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Accepting a service connection..
Sep 23 16:11:12 localhost SF-IMS[26192]: [26234] sftunneld:sf_heartbeat [INFO] Message Broker Service is published for peer 10.252.253.220
Sep 23 16:11:12 localhost SF-IMS[26192]: [26234] sftunneld:sf_peers [INFO] Using a 20 entry queue for 10.252.253.220 - 8306
Sep 23 16:11:12 localhost SF-IMS[26629]: EventHandlerPerl:41 [INFO] EventHandler is not running, skipping SIGNAL (SIGTERM)
Sep 23 16:11:12 localhost SF-IMS[26629]: EventHandlerPerl:117 [INFO] Already cleared /ngfw/var/sf/mabain/metadatastore/
Sep 23 16:11:12 localhost SF-IMS[26193]: [26197] sfmgr:sfmanager [INFO] Established connection to sftunnel for peer 10.252.253.220 (fd 10)
Sep 23 16:11:12 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Accepting a service connection..
Sep 23 16:11:12 localhost SF-IMS[26193]: [26889] sfmgr:sfmanager [INFO] Writing out service number - SFMGR for peer 10.252.253.220
Sep 23 16:11:12 localhost SF-IMS[26192]: [26234] sftunneld:sf_heartbeat [WARN] Service 6666 was already connected for peer 10.252.253.220
Sep 23 16:11:12 localhost SF-IMS[26192]: [26234] sftunneld:sf_peers [INFO] Using a 20 entry queue for 10.252.253.220 - 6666
Sep 23 16:11:12 localhost SF-IMS[26193]: [26235] sfmgr:sfmanager [INFO] Stop child thread for peer 10.252.253.220
Sep 23 16:11:12 localhost SF-IMS[26193]: [26235] sfmgr:sfmanager [INFO] Exiting child thread for peer 10.252.253.220
Sep 23 16:11:12 localhost SF-IMS[26193]: [26236] sfmgr:sfmanager [INFO] WRITE_THREAD:Terminated sftunnel write thread for peer 10.252.253.220
Sep 23 16:11:12 localhost SF-IMS[26193]: [26888] sfmgr:sfmanager [INFO] SFMGR is published on peer 10.252.253.220
Sep 23 16:11:12 localhost SF-IMS[26193]: [26888] sfmgr:sfmanager [INFO] SFMGR: UNIX socket '/ngfw/var/sf/peers/e2a0aed0-3108-11e5-966a-af6d2198b5cc/mgr.sox': 8 is listening...
Sep 23 16:11:12 localhost SF-IMS[26192]: [26234] sftunneld:sf_heartbeat [INFO] Saved SW VERSION from peer 10.252.253.220 (6.4.0.4)
Sep 23 16:11:12 localhost SF-IMS[26629]: ConfigFiles.pm:SF::PeerManager::ConfigFiles::create_sftunnel_config [INFO] sftunnel.conf file updated by /ngfw/usr/local/sf/bin/ActionQueueScrape.pl process from /ngfw/usr/local/sf/lib/perl/5.10.1/SF/PeerManager/PeerInfo.pm:837 at Sep 23 16:11:12
Sep 23 16:11:12 localhost SF-IMS[26192]: [26200] sftunneld:tunnsockets [INFO] Started listening on port 8305 IPv4(10.166.250.111) br1
Sep 23 16:11:13 localhost SF-IMS[26193]: [26235] sfmgr:sfmanager [INFO] free_peer 10.252.253.220.
Sep 23 16:11:14 localhost SF-IMS[26192]: [26201] sftunneld:sf_connections [INFO] Start connection to : 10.252.253.220 (wait 10 seconds is up)
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_peers [INFO] Peer 10.252.253.220 needs the second connection
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Interface br1 is configured for events on this Device
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Connect to 10.252.253.220 on port 8305 - br1
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Initiate IPv4 connection to 10.252.253.220 (via br1)
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Initiating IPv4 connection to 10.252.253.220:8305/tcp
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Wait to connect to 8305 (IPv6): 10.252.253.220
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Connected to 10.252.253.220:8305 (IPv4)
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Successfully connected using SSL to: '10.252.253.220'
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Peer 10.252.253.220 supports multiple ports
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Peer 10.252.253.220 supports separate events connection
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Peer 10.252.253.220 registration is complete remotely
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Connect: AUTHENTICATED peer '10.252.253.220'
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Connect: Second SSL_CTX for peer '10.252.253.220'
Sep 23 16:11:14 localhost SF-IMS[26192]: [26973] sftunneld:sf_ssl [INFO] Connect: Add second connection to peer '10.252.253.220'
Sep 23 16:11:14 localhost SF-IMS[26192]: [26234] sftunneld:control_services [INFO] Successfully Send Interfaces info to peer 10.252.253.220 over br1
Sep 23 16:11:14 localhost SF-IMS[26192]: [26234] sftunneld:sf_heartbeat [INFO] Saved SW VERSION from peer 10.252.253.220 (6.4.0.4)
Sep 23 16:11:14 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Need to send SW version and Published Services to 10.252.253.220
Sep 23 16:11:14 localhost SF-IMS[26192]: [26234] sftunneld:sf_peers [INFO] Confirm RPC service in CONTROL channel
Sep 23 16:11:14 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] >> ChannelState do_dataio_for_heartbeat peer 10.252.253.220 / channelA / CONTROL [ msgSock & ssl_context ] <<
Sep 23 16:11:15 localhost SF-IMS[26192]: [26234] sftunneld:control_services [INFO] Interface eth0 from 10.252.253.220 supports 'control events' 
Sep 23 16:11:15 localhost SF-IMS[26192]: [26234] sftunneld:control_services [INFO] Interface eth0 from 10.252.253.220 supports events 
Sep 23 16:11:15 localhost SF-IMS[26192]: [26234] sftunneld:control_services [INFO] Interface eth0 (10.252.253.220) from 10.252.253.220 is up 
Sep 23 16:11:15 localhost SF-IMS[26192]: [26234] sftunneld:control_services [INFO] Peer 10.252.253.220 Notified that it is NOT configured for dedicated events interface
Sep 23 16:11:15 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Need to send SW version and Published Services to 10.252.253.220
Sep 23 16:11:15 localhost SF-IMS[26192]: [26234] sftunneld:sf_peers [INFO] Confirm RPC service in CONTROL channel
Sep 23 16:11:15 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] >> ChannelState do_dataio_for_heartbeat peer 10.252.253.220 / channelA / CONTROL [ msgSock & ssl_context ] <<
Sep 23 16:11:15 localhost SF-IMS[26192]: [26234] sftunneld:sf_heartbeat [INFO] Saved SW VERSION from peer 10.252.253.220 (6.4.0.4)
Sep 23 16:11:15 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking SFDataCorrelator
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:ControlHandler [INFO] Handling control connection from sudo_user '', cmd '/ngfw/usr/bin/perl /ngfw/usr/local/sf/bin/ActionQueueScrape.pl', pid 27003 (uid 0, gid 0)
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:DCEControl [INFO] DCEControlMessageReconfigure
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:config [INFO] FMC HA is not configured
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:DCEControl [INFO] Pausing Event handlers
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:Correlator [INFO] DomainControl: Initialized 1 domains including 1 netmaps
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:Correlator [INFO] Global has 0 IP hosts and 0 MAC-only hosts
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:UserIdentity [INFO] user history records: 0, user low records: 5000000, user high records: 5500000
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:Affinity [INFO] File /ngfw/etc/sf/file_capabilities.conf not found on disk
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:Dispatcher [INFO] DCEDispatcherReconfigureAnalyzers calling reconfigure
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:FileProcessing [INFO] clear sandbox rate limit
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Archive Stats
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Inspected archives: 0
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Extracted files: 0
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Archive Status Stats
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Encrypted archives: 0
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:ARCHIVE_INSPECT [INFO] MaxDepth archives: 0
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Malformed archives: 0
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:ARCHIVE_INSPECT [INFO] File Type ID Stats
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:ARCHIVE_INSPECT [INFO]   UNKNOWN: 0
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Sandboxed archives: 0
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:ARCHIVE_INSPECT [INFO] No configuration found. Using defaults instead.
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:FileProcessing [INFO] FileProcessReconfigure: Preclass Engine Reloaded Successfully
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:EventStreamHandler [INFO] Adjusting Event Stream Threads
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:EventStreamHandler [INFO] Creating thread for peer 10.252.253.220
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:EventStreamHandler [INFO] Thread created
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:DCEControl [INFO] Resuming Event handlers
Sep 23 16:11:15 localhost SF-IMS[26760]: [27004] SFDataCorrelator:DCEControl [INFO] Reconfigure completed successfully
Sep 23 16:11:15 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking SFDataCorrelator
Sep 23 16:11:15 localhost SF-IMS[3558]: [3558] pm:process [INFO] Adding process: e2a0aed0-3108-11e5-966a-af6d2198b5cc-ep
Sep 23 16:11:15 localhost SF-IMS[3558]: [3558] pm:process [INFO] Started e2a0aed0-3108-11e5-966a-af6d2198b5cc-ep (27010)
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:EventStreamHandler [INFO] Starting Event Stream Handler for 10.252.253.220
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:EventStreamHandler [INFO] reconfiguring uip follower
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:FPReplicationFollowerUIP [INFO] Initializing FPReplicationFollowerBase for peer: e2a0aed0-3108-11e5-966a-af6d2198b5cc, service: 5000
Sep 23 16:11:15 localhost SF-IMS[26760]: [26824] SFDataCorrelator:RMQClient [INFO] e2a0aed0-3108-11e5-966a-af6d2198b5cc loading unprocessed messages
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:FPReplicationCommunicationRabbitFollower [INFO] Creating new AMQP connection for consuming user/ip messages, with max priority: 0 and heartbeat: 30
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:RMQClient [WARN] b:uip:cbfea864-fd16-11ea-8a9d-a3b63850626c failed to open socket: a socket error occurred
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:RMQClient [WARN] b:uip:cbfea864-fd16-11ea-8a9d-a3b63850626c failed to connect to rabbitmq server
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:FPReplicationCommunicationRabbitFollower [WARN] Cannot connect to AMQP server: 6
Sep 23 16:11:15 localhost SF-IMS[26760]: [26824] SFDataCorrelator:RMQClient [WARN] e2a0aed0-3108-11e5-966a-af6d2198b5cc failed to open socket: a socket error occurred
Sep 23 16:11:15 localhost SF-IMS[26760]: [26824] SFDataCorrelator:RMQClient [WARN] e2a0aed0-3108-11e5-966a-af6d2198b5cc failed to connect to rabbitmq server
Sep 23 16:11:15 localhost SF-IMS[26760]: [26824] SFDataCorrelator:RabbitMQThread [INFO] Connected to 1 Rabbit MQ peers
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:EventStreamHandler [INFO] reconfiguring ugm follower
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:FPReplicationFollowerUIP [INFO] Initializing FPReplicationFollowerBase for peer: e2a0aed0-3108-11e5-966a-af6d2198b5cc, service: 5001
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:FPReplicationCommunicationRabbitFollower [INFO] Creating new AMQP connection for consuming user/ip messages, with max priority: 0 and heartbeat: 30
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:RMQClient [WARN] b:ugm:cbfea864-fd16-11ea-8a9d-a3b63850626c failed to open socket: a socket error occurred
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:RMQClient [WARN] b:ugm:cbfea864-fd16-11ea-8a9d-a3b63850626c failed to connect to rabbitmq server
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:FPReplicationCommunicationRabbitFollower [WARN] Cannot connect to AMQP server: 6
Sep 23 16:11:15 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] fp replication follower consume messages-start
Sep 23 16:11:15 localhost SF-IMS[27010]: [27010] IDSEventProcessor:IDSEventProcessor [INFO] Started
Sep 23 16:11:15 localhost SF-IMS[27010]: [27010] IDSEventProcessor:DeMap [INFO] Not processing events for 555da0e2-fd17-11ea-9987-bbd63850626c.  Metadata is not present.
Sep 23 16:11:15 localhost SF-IMS[27010]: [27010] IDSEventProcessor:IDSEventProcessor [WARN] DE Start failed. No events for DE '555da0e2-fd17-11ea-9987-bbd63850626c' will be forwarded or processed
Sep 23 16:11:15 localhost SF-IMS[26760]: [27009] SFDataCorrelator:EventStreamHandler [INFO] Established estreamer connection to 10.252.253.220
Sep 23 16:11:15 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Accepting a service connection..
Sep 23 16:11:15 localhost SF-IMS[26192]: [26234] sftunneld:sf_heartbeat [INFO] Estreamer Events Service is published for peer 10.252.253.220
Sep 23 16:11:15 localhost SF-IMS[26192]: [26234] sftunneld:sf_peers [INFO] Using a 750 entry queue for 10.252.253.220 - 6667
Sep 23 16:11:15 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] Peer 10.252.253.220. SWITCH SERVICE 6667 CHANNEL 2
Sep 23 16:11:15 localhost SF-IMS[26760]: [27019] SFDataCorrelator:FPReplicationFollower [INFO] fp replication follower consume messages-start
Sep 23 16:11:15 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking ntpd
Sep 23 16:11:18 localhost SF-IMS[26195]: [26884] ipproxy:proxy_conn [INFO] Peer e2a0aed0-3108-11e5-966a-af6d2198b5cc connected
Sep 23 16:11:26 localhost SF-IMS[3558]: [3558] pm:process [INFO] Process ntpd (6326) stopped.
Sep 23 16:11:26 localhost SF-IMS[3558]: [3558] pm:log [INFO] Process 'ntpd' closed output.
Sep 23 16:11:26 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking ntpd
Sep 23 16:11:26 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking ntpd
Sep 23 16:11:26 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking ntpd
Sep 23 16:11:26 localhost SF-IMS[3558]: [3558] pm:process [INFO] Started ntpd (27115)
Sep 23 16:11:26 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking ntpd
Sep 23 16:11:26 localhost SF-IMS[27115]: [27115] pm:process [INFO] Successfully set oom_score_adj of -300 for process ntpd.
Sep 23 16:11:27 localhost SF-IMS[27115]: ntpd:ntpd [INFO] Running '/ngfw/usr/bin/ntpdate -q -u 10.251.57.177'
Sep 23 16:11:33 localhost SF-IMS[27115]: ntpd:ntpd [INFO] using ntp server: 10.251.57.177
Sep 23 16:11:33 localhost SF-IMS[3558]: [3558] pm:process [INFO] Process ntpd (27115) stopped.
Sep 23 16:11:33 localhost SF-IMS[3558]: [3558] pm:log [INFO] Process 'ntpd' closed output.
Sep 23 16:11:33 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking ntpd
Sep 23 16:11:33 localhost SF-IMS[3558]: [3558] pm:process [INFO] Started ntpd (27128)
Sep 23 16:11:33 localhost SF-IMS[27128]: [27128] pm:process [INFO] Successfully set oom_score_adj of -300 for process ntpd.
Sep 23 16:11:34 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO]  received: 12867957
Sep 23 16:11:34 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 0 requesting catchup, target seq_no: 12867956 ,req_id: 1 snapshot entry offset: 0
Sep 23 16:11:34 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:34 localhost SF-IMS[26760]: [26819] SFDataCorrelator:DMShmMgmt [INFO] removed database /ngfw/var/sf/sidns_download/dm_dns1.acl
Sep 23 16:11:34 localhost SF-IMS[26760]: [26819] SFDataCorrelator:DMShmMgmt [INFO] removed database /ngfw/var/sf/sifile_download/dm_file1.acl
Sep 23 16:11:34 localhost SF-IMS[26760]: [26819] SFDataCorrelator:ShmemDB [INFO] firewall rule ID file /ngfw/var/sf/sidns_download/dns.rules not found
Sep 23 16:11:34 localhost SF-IMS[26760]: [26819] SFDataCorrelator:ShmemDB [INFO] DNS Blacklisting database size: 1825, number of entries: 0
Sep 23 16:11:34 localhost SF-IMS[26760]: [26819] SFDataCorrelator:ShmemDB [INFO] firewall rule ID file /ngfw/var/sf/sifile_download/file.rules not found
Sep 23 16:11:34 localhost SF-IMS[26760]: [26819] SFDataCorrelator:ShmemDB [INFO] File Hash database size: 1825, number of entries: 0
Sep 23 16:11:34 localhost SF-IMS[27128]: ntpd:ntpd [INFO] Running '/ngfw/usr/bin/ntpdate -q -u 10.251.57.177'
Sep 23 16:11:34 localhost SF-IMS[3558]: [3558] pm:process [INFO] HUPing sfipproxy
Sep 23 16:11:34 localhost SF-IMS[26195]: [26195] ipproxy:ipproxy [INFO] Got HUP signal, re-reading configuration
Sep 23 16:11:34 localhost SF-IMS[26195]: [26195] ipproxy:ipproxy [INFO] Finished processing HUP signal
Sep 23 16:11:34 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking ntpd
Sep 23 16:11:34 localhost SF-IMS[26760]: [27015] SFDataCorrelator:Unified2Archive [INFO] Opened archive file '/ngfw/var/sf/user_enforcement/temp_uip.e2a0aed0-3108-11e5-966a-af6d2198b5cc.snapshot.1600877494'
Sep 23 16:11:34 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 0 requesting catchup, target seq_no: 0 ,req_id: 2 snapshot entry offset: 1530
Sep 23 16:11:34 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:35 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 0 requesting catchup, target seq_no: 0 ,req_id: 3 snapshot entry offset: 3061
Sep 23 16:11:35 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:35 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] received end of snapshot entry msg, seq_no is: 12822604, with no_entries: 3232
Sep 23 16:11:35 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollowerUIP [INFO] uip follower starts processing snapshot /var/sf/user_enforcement/temp_uip.e2a0aed0-3108-11e5-966a-af6d2198b5cc.snapshot.1600877494, login_sessions_count: 0
Sep 23 16:11:38 localhost SF-IMS[26760]: [27015] SFDataCorrelator:UserIdentity [INFO] Creating User IP Map snapshots snapshot_flag = 1
Sep 23 16:11:38 localhost SF-IMS[26760]: [27015] SFDataCorrelator:Unified2Archive [INFO] Opened archive file '/ngfw/var/sf/user_enforcement/user_ip_map.snapshot.1600877498'
Sep 23 16:11:38 localhost SF-IMS[26760]: [27015] SFDataCorrelator:UserIdentity [INFO] generating snapshot ctl msg for timestamp: 1600877498, snapshot_type 0
Sep 23 16:11:38 localhost SF-IMS[26760]: [27015] SFDataCorrelator:Unified2Archive [INFO] Opened archive file '/ngfw/var/sf/user_enforcement/user_ip_map.1600877498'
Sep 23 16:11:38 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollowerUIP [INFO] uip follower finished processing snapshot, login_sessions_count: 3232
Sep 23 16:11:38 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12822605 requesting catchup, target seq_no: 0 ,req_id: 4 snapshot entry offset: 0
Sep 23 16:11:38 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:39 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12823798 requesting catchup, target seq_no: 12867960 ,req_id: 5 snapshot entry offset: 0
Sep 23 16:11:39 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:40 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12824993 requesting catchup, target seq_no: 12867960 ,req_id: 6 snapshot entry offset: 0
Sep 23 16:11:40 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:41 localhost SF-IMS[27128]: ntpd:ntpd [INFO] using ntp server: 10.251.57.177
Sep 23 16:11:41 localhost SF-IMS[3558]: [3558] pm:process [INFO] Process ntpd (27128) stopped.
Sep 23 16:11:41 localhost SF-IMS[3558]: [3558] pm:log [INFO] Process 'ntpd' closed output.
Sep 23 16:11:41 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking ntpd
Sep 23 16:11:41 localhost SF-IMS[3558]: [3558] pm:process [INFO] Started ntpd (27141)
Sep 23 16:11:41 localhost SF-IMS[27141]: [27141] pm:process [INFO] Successfully set oom_score_adj of -300 for process ntpd.
Sep 23 16:11:42 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12826191 requesting catchup, target seq_no: 12867960 ,req_id: 7 snapshot entry offset: 0
Sep 23 16:11:42 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:42 localhost SF-IMS[27141]: ntpd:ntpd [INFO] Running '/ngfw/usr/bin/ntpdate -q -u 10.251.57.177'
Sep 23 16:11:44 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12827384 requesting catchup, target seq_no: 12867960 ,req_id: 8 snapshot entry offset: 0
Sep 23 16:11:44 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:46 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12828575 requesting catchup, target seq_no: 12867960 ,req_id: 9 snapshot entry offset: 0
Sep 23 16:11:46 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:46 localhost SF-IMS[26760]: [27019] SFDataCorrelator:FPReplicationFollower [INFO] requesting msg_timeout catchup
Sep 23 16:11:46 localhost SF-IMS[26760]: [27019] SFDataCorrelator:FPReplicationFollower [INFO] UserGroupFollower expecting: 0 requesting catchup, target seq_no: 0 ,req_id: 1 snapshot entry offset: 0
Sep 23 16:11:46 localhost SF-IMS[26760]: [27019] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:48 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12829769 requesting catchup, target seq_no: 12867960 ,req_id: 10 snapshot entry offset: 0
Sep 23 16:11:48 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:49 localhost SF-IMS[27141]: ntpd:ntpd [INFO] using ntp server: 10.251.57.177
Sep 23 16:11:49 localhost SF-IMS[27141]: ntpd:ntpd [INFO] Running '/ngfw/usr/bin/ntpdate -u 10.251.57.177'
Sep 23 16:11:49 localhost SF-IMS[26760]: [27019] SFDataCorrelator:UserIdentity [INFO] Creating User IP Map snapshots snapshot_flag = 1
Sep 23 16:11:49 localhost SF-IMS[26760]: [27019] SFDataCorrelator:Unified2Archive [INFO] Opened archive file '/ngfw/var/sf/user_enforcement/user_ip_map.snapshot.1600877509'
Sep 23 16:11:49 localhost SF-IMS[26760]: [27019] SFDataCorrelator:UserIdentity [INFO] generating snapshot ctl msg for timestamp: 1600877509, snapshot_type 0
Sep 23 16:11:49 localhost SF-IMS[26760]: [27019] SFDataCorrelator:Unified2Archive [INFO] Opened archive file '/ngfw/var/sf/user_enforcement/user_ip_map.1600877509'
Sep 23 16:11:49 localhost SF-IMS[26760]: [27019] SFDataCorrelator:FPReplicationFollower [INFO] UserGroupFollower expecting: 1 requesting catchup, target seq_no: 0 ,req_id: 2 snapshot entry offset: 0
Sep 23 16:11:49 localhost SF-IMS[26760]: [27019] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:49 localhost SF-IMS[26760]: [27019] SFDataCorrelator:FPReplicationFollower [INFO] received catchup entry up-to-date msg.
Sep 23 16:11:49 localhost SF-IMS[26760]: [27019] SFDataCorrelator:FPReplicationFollower [INFO] begin to process 0 buffered messages
Sep 23 16:11:49 localhost SF-IMS[26760]: [27019] SFDataCorrelator:FPReplicationFollower [INFO] completely processed buffered broadcast messages.
Sep 23 16:11:50 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12830958 requesting catchup, target seq_no: 12867960 ,req_id: 11 snapshot entry offset: 0
Sep 23 16:11:50 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:51 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12832144 requesting catchup, target seq_no: 12867960 ,req_id: 12 snapshot entry offset: 0
Sep 23 16:11:51 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:52 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12833329 requesting catchup, target seq_no: 12867960 ,req_id: 13 snapshot entry offset: 0
Sep 23 16:11:52 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:53 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12834516 requesting catchup, target seq_no: 12867960 ,req_id: 14 snapshot entry offset: 0
Sep 23 16:11:53 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:54 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12835701 requesting catchup, target seq_no: 12867960 ,req_id: 15 snapshot entry offset: 0
Sep 23 16:11:54 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:55 localhost SF-IMS[27141]: ntpd:ntpd [INFO] Updated system clock by offset of 0.002273 seconds
Sep 23 16:11:55 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12836890 requesting catchup, target seq_no: 12867960 ,req_id: 16 snapshot entry offset: 0
Sep 23 16:11:55 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:57 localhost ntpd[27192]: ntpd 4.2.8p11@1.3728-o Tue Apr 23 03:38:36 UTC 2019 (1): Starting
Sep 23 16:11:57 localhost ntpd[27192]: Command line: /ngfw/usr/bin/ntpd -n -p /var/run/ntpd.pid -c /ngfw/etc/ntp.conf -I lo -I br1 br1
Sep 23 16:11:57 localhost ntpd[27192]: proto: precision = 0.085 usec (-23)
Sep 23 16:11:57 localhost ntpd[27192]: switching logging to file /ngfw/var/log/ntp.log
Sep 23 16:11:57 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12838080 requesting catchup, target seq_no: 12867960 ,req_id: 17 snapshot entry offset: 0
Sep 23 16:11:57 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:57 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking SFDataCorrelator
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:ControlHandler [INFO] Handling control connection from sudo_user '', cmd '/ngfw/usr/bin/perl /ngfw/usr/local/sf/bin/ActionQueueScrape.pl', pid 27199 (uid 0, gid 0)
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:DCEControl [INFO] DCEControlMessageReconfigure
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:config [INFO] FMC HA is not configured
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:DCEControl [INFO] Pausing Event handlers
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:Correlator [INFO] DomainControl: Initialized 1 domains including 1 netmaps
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:UserIdentity [INFO] user history records: 0, user low records: 5000000, user high records: 5500000
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:Affinity [INFO] File /ngfw/etc/sf/file_capabilities.conf not found on disk
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:Dispatcher [INFO] DCEDispatcherReconfigureAnalyzers calling reconfigure
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:FileProcessing [INFO] clear sandbox rate limit
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Archive Stats
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Inspected archives: 0
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Extracted files: 0
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Archive Status Stats
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Encrypted archives: 0
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:ARCHIVE_INSPECT [INFO] MaxDepth archives: 0
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Malformed archives: 0
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:ARCHIVE_INSPECT [INFO] File Type ID Stats
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:ARCHIVE_INSPECT [INFO]   UNKNOWN: 0
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Sandboxed archives: 0
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:ARCHIVE_INSPECT [INFO] No configuration found. Using defaults instead.
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:FileProcessing [INFO] FileProcessReconfigure: Preclass Engine Reloaded Successfully
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:EventStreamHandler [INFO] Adjusting Event Stream Threads
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:DCEControl [INFO] Resuming Event handlers
Sep 23 16:11:57 localhost SF-IMS[26760]: [27201] SFDataCorrelator:DCEControl [INFO] Reconfigure completed successfully
Sep 23 16:11:57 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking SFDataCorrelator
Sep 23 16:11:57 localhost SF-IMS[26760]: [26824] SFDataCorrelator:RMQClient [INFO] e2a0aed0-3108-11e5-966a-af6d2198b5cc loading unprocessed messages
Sep 23 16:11:58 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12839268 requesting catchup, target seq_no: 12867960 ,req_id: 18 snapshot entry offset: 0
Sep 23 16:11:58 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:58 localhost SF-IMS[26760]: [26824] SFDataCorrelator:RabbitMQThread [INFO] Connected to 1 Rabbit MQ peers
Sep 23 16:11:59 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12840459 requesting catchup, target seq_no: 12867960 ,req_id: 19 snapshot entry offset: 0
Sep 23 16:11:59 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:11:59 localhost SF-IMS[26760]: [26819] SFDataCorrelator:DMShmMgmt [INFO] removed database /ngfw/var/sf/sidns_download/dm_dns0.acl
Sep 23 16:11:59 localhost SF-IMS[26760]: [26819] SFDataCorrelator:DMShmMgmt [INFO] removed database /ngfw/var/sf/sifile_download/dm_file0.acl
Sep 23 16:12:01 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12841652 requesting catchup, target seq_no: 12867960 ,req_id: 20 snapshot entry offset: 0
Sep 23 16:12:01 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:01 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Accepting a service connection..
Sep 23 16:12:01 localhost SF-IMS[26192]: [26234] sftunneld:sf_heartbeat [INFO] CSM_CCM service is published for peer 10.252.253.220
Sep 23 16:12:01 localhost SF-IMS[26192]: [26234] sftunneld:sf_peers [INFO] Using a 750 entry queue for 10.252.253.220 - 9009
Sep 23 16:12:01 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] Peer 10.252.253.220. SWITCH SERVICE 9009 CHANNEL 2
Sep 23 16:12:02 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12842846 requesting catchup, target seq_no: 12867960 ,req_id: 21 snapshot entry offset: 0
Sep 23 16:12:02 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:04 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12844033 requesting catchup, target seq_no: 12867960 ,req_id: 22 snapshot entry offset: 0
Sep 23 16:12:04 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:05 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12845222 requesting catchup, target seq_no: 12867960 ,req_id: 23 snapshot entry offset: 0
Sep 23 16:12:05 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:06 localhost SF-IMS[26760]: [26808] SFDataCorrelator:adi.subscriber [WARN] ADI Subscriber connection failed: socket name = /tmp/vdi.socket
Sep 23 16:12:06 localhost SF-IMS[26760]: [27226] SFDataCorrelator:ControlHandler [INFO] Handling control connection from sudo_user '', cmd '/ngfw/usr/bin/perl /ngfw/usr/local/sf/bin/ActionQueueScrape.pl', pid 27188 (uid 0, gid 0)
Sep 23 16:12:06 localhost SF-IMS[26760]: [27226] SFDataCorrelator:HandleUserMessage [INFO] CHANGE_USER_RELOAD_URLDB message
Sep 23 16:12:06 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12846411 requesting catchup, target seq_no: 12867960 ,req_id: 24 snapshot entry offset: 0
Sep 23 16:12:06 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:07 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12847600 requesting catchup, target seq_no: 12867960 ,req_id: 25 snapshot entry offset: 0
Sep 23 16:12:07 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:08 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12848792 requesting catchup, target seq_no: 12867960 ,req_id: 26 snapshot entry offset: 0
Sep 23 16:12:08 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:09 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Accepting a service connection..
Sep 23 16:12:09 localhost SF-IMS[26192]: [26234] sftunneld:sf_heartbeat [INFO] Malware Lookup Service is published for peer 10.252.253.220.
Sep 23 16:12:09 localhost SF-IMS[26192]: [26234] sftunneld:sf_peers [INFO] Using a 750 entry queue for 10.252.253.220 - 7700
Sep 23 16:12:09 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] Peer 10.252.253.220. SWITCH SERVICE 7700 CHANNEL 2
Sep 23 16:12:10 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12849985 requesting catchup, target seq_no: 12867960 ,req_id: 27 snapshot entry offset: 0
Sep 23 16:12:10 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:10 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Accepting a service connection..
Sep 23 16:12:10 localhost SF-IMS[26192]: [26234] sftunneld:sf_heartbeat [INFO] Identity Service is published for peer 10.252.253.220
Sep 23 16:12:10 localhost SF-IMS[26192]: [26234] sftunneld:sf_peers [INFO] Using a 20 entry queue for 10.252.253.220 - 7770
Sep 23 16:12:10 localhost SF-IMS[26192]: [26234] sftunneld:control_services [INFO] Interface eth0 from 10.252.253.220 supports 'control events' 
Sep 23 16:12:10 localhost SF-IMS[26192]: [26234] sftunneld:control_services [INFO] Interface eth0 from 10.252.253.220 supports events 
Sep 23 16:12:10 localhost SF-IMS[26192]: [26234] sftunneld:control_services [INFO] Interface eth0 (10.252.253.220) from 10.252.253.220 is up 
Sep 23 16:12:10 localhost SF-IMS[26192]: [26234] sftunneld:control_services [INFO] Peer 10.252.253.220 Notified that it is NOT configured for dedicated events interface
Sep 23 16:12:10 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Need to send SW version and Published Services to 10.252.253.220
Sep 23 16:12:10 localhost SF-IMS[26192]: [26234] sftunneld:sf_peers [INFO] Confirm RPC service in CONTROL channel
Sep 23 16:12:10 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] >> ChannelState do_dataio_for_heartbeat peer 10.252.253.220 / channelA / CONTROL [ msgSock & ssl_context ] <<
Sep 23 16:12:11 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12851168 requesting catchup, target seq_no: 12867960 ,req_id: 28 snapshot entry offset: 0
Sep 23 16:12:11 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:12 localhost SF-IMS[26193]: [26193] sfmgr:sfmanager [INFO] Process received SIGHUP
Sep 23 16:12:12 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12852352 requesting catchup, target seq_no: 12867960 ,req_id: 29 snapshot entry offset: 0
Sep 23 16:12:12 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:13 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12853535 requesting catchup, target seq_no: 12867960 ,req_id: 30 snapshot entry offset: 0
Sep 23 16:12:13 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:14 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12854723 requesting catchup, target seq_no: 12867960 ,req_id: 31 snapshot entry offset: 0
Sep 23 16:12:14 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:15 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12855911 requesting catchup, target seq_no: 12867960 ,req_id: 32 snapshot entry offset: 0
Sep 23 16:12:15 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:15 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12857087 requesting catchup, target seq_no: 12867960 ,req_id: 33 snapshot entry offset: 0
Sep 23 16:12:15 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:16 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12858269 requesting catchup, target seq_no: 12867960 ,req_id: 34 snapshot entry offset: 0
Sep 23 16:12:16 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:17 localhost SF-IMS[26760]: [27232] SFDataCorrelator:adi.subscriber [ERROR] Timeout while receiving bulksync ack response
Sep 23 16:12:17 localhost SF-IMS[26760]: [27232] SFDataCorrelator:IdentityChannel [WARN] Failed to request bulksync from adi
Sep 23 16:12:17 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12859449 requesting catchup, target seq_no: 12867960 ,req_id: 35 snapshot entry offset: 0
Sep 23 16:12:17 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:17 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking SFDataCorrelator
Sep 23 16:12:17 localhost SF-IMS[26760]: [27252] SFDataCorrelator:ControlHandler [INFO] Handling control connection from sudo_user '', cmd '/ngfw/usr/bin/perl /ngfw/usr/local/sf/bin/ActionQueueScrape.pl', pid 27251 (uid 0, gid 0)
Sep 23 16:12:17 localhost SF-IMS[26760]: [27252] SFDataCorrelator:DCEControl [INFO] DCEControlMessageReconfigure
Sep 23 16:12:17 localhost SF-IMS[26760]: [27252] SFDataCorrelator:config [INFO] FMC HA is not configured
Sep 23 16:12:17 localhost SF-IMS[26760]: [27252] SFDataCorrelator:DCEControl [INFO] Pausing Event handlers
Sep 23 16:12:17 localhost SF-IMS[26760]: [27252] SFDataCorrelator:Correlator [INFO] DomainControl: Initialized 1 domains including 1 netmaps
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:UserIdentity [INFO] user history records: 0, user low records: 5000000, user high records: 5500000
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:Affinity [INFO] File /ngfw/etc/sf/file_capabilities.conf not found on disk
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:Dispatcher [INFO] DCEDispatcherReconfigureAnalyzers calling reconfigure
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:FileProcessing [INFO] clear sandbox rate limit
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Archive Stats
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Inspected archives: 0
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Extracted files: 0
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Archive Status Stats
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Encrypted archives: 0
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:ARCHIVE_INSPECT [INFO] MaxDepth archives: 0
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Malformed archives: 0
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:ARCHIVE_INSPECT [INFO] File Type ID Stats
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:ARCHIVE_INSPECT [INFO]   UNKNOWN: 0
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Sandboxed archives: 0
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:ARCHIVE_INSPECT [INFO] No configuration found. Using defaults instead.
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:FileProcessing [INFO] FileProcessReconfigure: Preclass Engine Reloaded Successfully
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:EventStreamHandler [INFO] Adjusting Event Stream Threads
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:DCEControl [INFO] Resuming Event handlers
Sep 23 16:12:18 localhost SF-IMS[26760]: [27252] SFDataCorrelator:DCEControl [INFO] Reconfigure completed successfully
Sep 23 16:12:18 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking SFDataCorrelator
Sep 23 16:12:18 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12860634 requesting catchup, target seq_no: 12867960 ,req_id: 36 snapshot entry offset: 0
Sep 23 16:12:18 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:18 localhost SF-IMS[26760]: [26824] SFDataCorrelator:RabbitMQThread [INFO] Connected to 1 Rabbit MQ peers
Sep 23 16:12:19 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12861810 requesting catchup, target seq_no: 12867960 ,req_id: 37 snapshot entry offset: 0
Sep 23 16:12:19 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:19 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12862985 requesting catchup, target seq_no: 12867960 ,req_id: 38 snapshot entry offset: 0
Sep 23 16:12:19 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:20 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12864163 requesting catchup, target seq_no: 12867960 ,req_id: 39 snapshot entry offset: 0
Sep 23 16:12:20 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:21 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12865338 requesting catchup, target seq_no: 12867960 ,req_id: 40 snapshot entry offset: 0
Sep 23 16:12:21 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:22 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12866519 requesting catchup, target seq_no: 12867960 ,req_id: 41 snapshot entry offset: 0
Sep 23 16:12:22 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:22 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] UserIPFollower expecting: 12867681 requesting catchup, target seq_no: 12867960 ,req_id: 42 snapshot entry offset: 0
Sep 23 16:12:22 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] published catchup request
Sep 23 16:12:23 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] received end of catchup entry msg, seq_no is: 12867960
Sep 23 16:12:23 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] begin to process 54 buffered messages
Sep 23 16:12:23 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] completely processed buffered broadcast messages.
Sep 23 16:12:42 localhost SF-IMS[26192]: [26192] sftunneld:sftunnel [INFO] Processing SIGHUP started
Sep 23 16:12:42 localhost SF-IMS[26192]: [26192] sftunneld:sftunnel [INFO] ROLE=1
Sep 23 16:12:42 localhost SF-IMS[26192]: [26192] sftunneld:sftunnel [INFO] IPv4 is  10.166.250.111  (key '10.166.250.111') on br1
Sep 23 16:12:42 localhost SF-IMS[26192]: [26192] sftunneld:sftunnel [INFO] Local Peer supports separate events connection
Sep 23 16:12:42 localhost SF-IMS[26192]: [26192] sftunneld:sftunnel [INFO] Processing SIGHUP completed
Sep 23 16:12:42 localhost SF-IMS[26192]: [26234] sftunneld:control_services [INFO] Successfully Send Interfaces info to peer 10.252.253.220 over br1
Sep 23 16:12:42 localhost SF-IMS[26192]: [26234] sftunneld:sf_heartbeat [INFO] Saved SW VERSION from peer 10.252.253.220 (6.4.0.4)
Sep 23 16:12:43 localhost SF-IMS[26192]: [26882] sftunneld:UEChannel [INFO] Loading DE configuration for service = 9100
Sep 23 16:12:43 localhost SF-IMS[26192]: [26882] sftunneld:UEChannel [INFO] Loading file processing config for service 9100
Sep 23 16:12:43 localhost SF-IMS[26192]: [26882] sftunneld:UEChannel [INFO] Loading VPN User config for service 9100
Sep 23 16:12:43 localhost SF-IMS[26192]: [26882] sftunneld:UEChannel [INFO] No VPN user config found
Sep 23 16:12:43 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] Loading DE configuration for service = 9101
Sep 23 16:12:43 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] Loading file processing config for service 9101
Sep 23 16:12:43 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] Loading VPN User config for service 9101
Sep 23 16:12:43 localhost SF-IMS[26192]: [26883] sftunneld:UEChannel [INFO] No VPN user config found





Sep 23 16:15:55 localhost SF-IMS[26192]: [26234] sftunneld:sf_heartbeat [INFO] Received message for not published service 7000 for peer 10.252.253.220.

Sep 23 16:16:30 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking SFDataCorrelator
Sep 23 16:16:30 localhost SF-IMS[26760]: [27600] SFDataCorrelator:ControlHandler [INFO] Handling control connection from sudo_user '', cmd '/ngfw/usr/bin/perl /ngfw/usr/local/sf/bin/ActionQueueScrape.pl', pid 27598 (uid 0, gid 0)
Sep 23 16:16:30 localhost SF-IMS[26760]: [27600] SFDataCorrelator:HandleUserMessage [INFO] CHANGE_USER_REREAD_CAPS message
Sep 23 16:16:30 localhost SF-IMS[26760]: [27600] SFDataCorrelator:DataMessaging_URLFilteringLicense [INFO] Licensed: Use vendor service for cache misses enabled
Sep 23 16:16:30 localhost SF-IMS[26760]: [27600] SFDataCorrelator:DataMessaging_URLFilteringLicense [INFO] Licensed: URL Filtering feature startup
Sep 23 16:16:30 localhost SF-IMS[26760]: [27600] SFDataCorrelator:URLUserIP_CorrelatorThread [INFO] urlFiltering feature 2
Sep 23 16:16:30 localhost SF-IMS[26760]: [27600] SFDataCorrelator:url_license [INFO] number of classical URL licenses is 0
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:ControlHandler [INFO] Handling control connection from sudo_user '', cmd '/ngfw/usr/bin/perl /ngfw/usr/local/sf/bin/ActionQueueScrape.pl', pid 27598 (uid 0, gid 0)
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:DCEControl [INFO] DCEControlMessageReconfigure
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:config [INFO] FMC HA is not configured
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:DCEControl [INFO] Pausing Event handlers
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:Correlator [INFO] DomainControl: Initialized 1 domains including 1 netmaps
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:UserIdentity [INFO] user history records: 0, user low records: 5000000, user high records: 5500000
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:Affinity [INFO] File /ngfw/etc/sf/file_capabilities.conf not found on disk
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:Dispatcher [INFO] DCEDispatcherReconfigureAnalyzers calling reconfigure
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:FileProcessing [INFO] clear sandbox rate limit
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Archive Stats
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Inspected archives: 0
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Extracted files: 0
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Archive Status Stats
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Encrypted archives: 0
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:ARCHIVE_INSPECT [INFO] MaxDepth archives: 0
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Malformed archives: 0
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:ARCHIVE_INSPECT [INFO] File Type ID Stats
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:ARCHIVE_INSPECT [INFO]   UNKNOWN: 0
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Sandboxed archives: 0
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:ARCHIVE_INSPECT [INFO] No configuration found. Using defaults instead.
Sep 23 16:16:30 localhost SF-IMS[26760]: [26824] SFDataCorrelator:RabbitMQThread [INFO] Connected to 1 Rabbit MQ peers
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:FileProcessing [INFO] FileProcessReconfigure: Preclass Engine Reloaded Successfully
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:EventStreamHandler [INFO] Adjusting Event Stream Threads
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:DCEControl [INFO] Resuming Event handlers
Sep 23 16:16:30 localhost SF-IMS[26760]: [27605] SFDataCorrelator:DCEControl [INFO] Reconfigure completed successfully
Sep 23 16:16:30 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking SFDataCorrelator
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_ch_util [INFO] Unable to receive message from 10.252.253.220:Closed
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_ch_util [INFO]  (5.5.6) Broken event connection to peer 10.252.253.220
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Failed to send in event channel for peer 10.252.253.220 (br1), error (Closed)
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] >> ChannelState dropChannel peer 10.252.253.220 / channelB / EVENT [ msgSock2 & ssl_context2 ] <<
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] >> ChannelState freeChannel peer 10.252.253.220 / channelB / DROPPED [ msgSock2 & ssl_context2 ] <<
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Need to send SW version and Published Services to 10.252.253.220
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_peers [INFO] Confirm RPC service in CONTROL channel
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] >> ChannelState do_dataio_for_heartbeat peer 10.252.253.220 / channelA / CONTROL [ msgSock & ssl_context ] <<
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:control_services [INFO] Successfully Send Interfaces info to peer 10.252.253.220 over br1
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Unable to receive message from peer 10.252.253.220:Closed
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] >> ChannelState dropChannel peer 10.252.253.220 / channelA / CONTROL [ msgSock & ssl_context ] <<
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Exiting channel (recv). Peer 10.252.253.220 closed connection on interface br1.
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Failed to send in control channel for peer 10.252.253.220 (br1)
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] >> ChannelState dropChannel peer 10.252.253.220 / channelA / DROPPED [ msgSock & ssl_context ] <<
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] >> ChannelState freeChannel peer 10.252.253.220 / channelA / DROPPED [ msgSock & ssl_context ] <<
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] ChannelState Peer 10.252.253.220 TOP OF THE LOOP CHANNEL COUNT 0
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] <<<<<<<<<<<<<<<<<<<<<< ShutDownPeer 5601-firesight.sitel-world.net >>>>>>>>>>>>>>>>>>>>>>>>
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:TunnelService [INFO] UEC service 9101 is signaled to exit for peer 10.252.253.220
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:TunnelService [INFO] UEC service 9100 is signaled to exit for peer 10.252.253.220
Sep 23 16:16:39 localhost SF-IMS[26192]: [26234] sftunneld:TunnelService [WARN] UEC service 9101 exited for peer 10.252.253.220
Sep 23 16:16:39 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking sfipproxy
Sep 23 16:16:39 localhost SF-IMS[26760]: [27015] SFDataCorrelator:RMQClient [WARN] connection closed, need to reconnect
Sep 23 16:16:39 localhost SF-IMS[26760]: [27015] SFDataCorrelator:RMQClient [WARN] b:uip:cbfea864-fd16-11ea-8a9d-a3b63850626c failed to open socket: a socket error occurred
Sep 23 16:16:39 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationCommunicationRabbit [WARN] unable to establish connection, rval is: 6, attempt number: 0
Sep 23 16:16:39 localhost SF-IMS[26760]: [27019] SFDataCorrelator:RMQClient [WARN] connection closed, need to reconnect
Sep 23 16:16:39 localhost SF-IMS[26760]: [27019] SFDataCorrelator:RMQClient [WARN] b:ugm:cbfea864-fd16-11ea-8a9d-a3b63850626c failed to open socket: a socket error occurred
Sep 23 16:16:39 localhost SF-IMS[26760]: [27019] SFDataCorrelator:FPReplicationCommunicationRabbit [WARN] unable to establish connection, rval is: 6, attempt number: 0
Sep 23 16:16:39 localhost SF-IMS[3558]: [3558] pm:process [INFO] Process sfipproxy (26195) stopped.
Sep 23 16:16:39 localhost SF-IMS[3558]: [3558] pm:log [INFO] Process 'sfipproxy' closed output.
Sep 23 16:16:39 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking sfipproxy
Sep 23 16:16:39 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking sftunnel
Sep 23 16:16:39 localhost SF-IMS[3558]: [3558] pm:process [INFO] Stopping sftunnel's dependent sfmgr
Sep 23 16:16:39 localhost SF-IMS[3558]: [3558] pm:process [INFO] Stopping sftunnel's dependent sfmbservice
Sep 23 16:16:39 localhost SF-IMS[26193]: [26193] sfmgr:sfmanager [INFO] Process recieved SIGTERM
Sep 23 16:16:39 localhost SF-IMS[26193]: [26193] sfmgr:sfmanager [INFO] MARK TO FREE peer 10.252.253.220
Sep 23 16:16:39 localhost SF-IMS[26194]: [26194] sfmbservice:sfmb_service [INFO] sfmbservice received SIGTERM. Processing it now
Sep 23 16:16:40 localhost SF-IMS[26193]: [26889] sfmgr:sfmanager [INFO] WRITE_THREAD:Terminated sftunnel write thread for peer 10.252.253.220
Sep 23 16:16:40 localhost SF-IMS[26192]: [26234] sftunneld:TunnelService [WARN] UEC service 9100 exited for peer 10.252.253.220
Sep 23 16:16:40 localhost SF-IMS[26192]: [26234] sftunneld:stream_file [INFO] Stream CTX destroyed for 10.252.253.220
Sep 23 16:16:40 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] >> ChannelState ShutDownPeer peer 10.252.253.220 / channelA / NONE [ msgSock & ssl_context ] <<
Sep 23 16:16:40 localhost SF-IMS[26192]: [26234] sftunneld:sf_channel [INFO] >> ChannelState ShutDownPeer peer 10.252.253.220 / channelB / DROPPED [ msgSock & ssl_context ] <<
Sep 23 16:16:40 localhost SF-IMS[26192]: [26234] sftunneld:sf_connections [INFO] Peer 10.252.253.220 needs re-connect
Sep 23 16:16:40 localhost SF-IMS[26760]: [27232] SFDataCorrelator:IdentityChannel [WARN] Disconnecting from peer
Sep 23 16:16:40 localhost SF-IMS[26760]: [27232] SFDataCorrelator:IdentityChannel [INFO] Peer status for peer e2a0aed0-3108-11e5-966a-af6d2198b5cc is 0
Sep 23 16:16:40 localhost SF-IMS[26760]: [27232] SFDataCorrelator:IdentityChannel [ERROR] Failed to connect to tunnel (e2a0aed0-3108-11e5-966a-af6d2198b5cc), error: Not connected
Sep 23 16:16:40 localhost SF-IMS[26193]: [26888] sfmgr:sfmanager [INFO] Stop child thread for peer 10.252.253.220
Sep 23 16:16:40 localhost SF-IMS[26193]: [26888] sfmgr:sfmanager [INFO] Exiting child thread for peer 10.252.253.220
Sep 23 16:16:40 localhost SF-IMS[26193]: [26888] sfmgr:sfmanager [INFO] free_peer 10.252.253.220.
Sep 23 16:16:40 localhost SF-IMS[26760]: [27230] SFDataCorrelator:CorrelatorChannelThread [ERROR] poll file descriptor error 17 for peer e2a0aed0-3108-11e5-966a-af6d2198b5cc
Sep 23 16:16:40 localhost SF-IMS[26760]: [27230] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (e2a0aed0-3108-11e5-966a-af6d2198b5cc), error: Not connected
Sep 23 16:16:40 localhost SF-IMS[26760]: [27009] SFDataCorrelator:EventStreamHandler [ERROR] SFTunnelReadBuffer returned 26: Closed
Sep 23 16:16:40 localhost SF-IMS[26760]: [27009] SFDataCorrelator:EventStreamHandler [ERROR] Unable to receive message: Closed
Sep 23 16:16:40 localhost SF-IMS[26760]: [27009] SFDataCorrelator:EventStreamHandler [INFO] Reset: Closing estreamer connection to: 10.252.253.220
Sep 23 16:16:40 localhost SF-IMS[26192]: [26200] sftunneld:tunnsockets [INFO] Started listening on port 8305 IPv4(10.166.250.111) br1
Sep 23 16:16:42 localhost SF-IMS[26193]: [26193] sfmgr:sfmanager [INFO] Shutting down RPC after threads exited
Sep 23 16:16:42 localhost SF-IMS[26193]: [26193] sfmgr:sfmanager [INFO] RPC service is Exiting...exit code is: 0
Sep 23 16:16:42 localhost SF-IMS[3558]: [3558] pm:process [INFO] Process sfmgr (26193) stopped.
Sep 23 16:16:44 localhost SF-IMS[26194]: [26194] sfmbservice:sfmb_service [INFO] Destroyed configuration...
Sep 23 16:16:44 localhost SF-IMS[26194]: [26194] sfmbservice:sfmb_service [INFO] MB Events Service is Exiting...exit code is: 0
Sep 23 16:16:44 localhost SF-IMS[3558]: [3558] pm:process [INFO] Process sfmbservice (26194) stopped.
Sep 23 16:16:44 localhost SF-IMS[26192]: [26192] sftunneld:sftunnel [INFO] Process received SIGTERM
Sep 23 16:16:44 localhost SF-IMS[26192]: [26192] sftunneld:sf_peers [INFO] Free not connected peer 10.252.253.220
Sep 23 16:16:44 localhost SF-IMS[26192]: [26192] sftunneld:sf_peers [INFO] Free peer 10.252.253.220 
Sep 23 16:16:44 localhost SF-IMS[26192]: [26192] sftunneld:sf_channel [INFO] >> ChannelState free_peer peer 10.252.253.220 / channelA / DROPPED [ msgSock & ssl_context ] <<
Sep 23 16:16:44 localhost SF-IMS[26192]: [26192] sftunneld:sf_channel [INFO] >> ChannelState free_peer peer 10.252.253.220 / channelB / DROPPED [ msgSock & ssl_context ] <<
Sep 23 16:16:44 localhost SF-IMS[26192]: [26192] sftunneld:stream_file [INFO] Stream CTX destroyed for 10.252.253.220
Sep 23 16:16:44 localhost SF-IMS[26192]: [26192] sftunneld:sf_peers [INFO] Free peer 10.252.253.220 on exit
Sep 23 16:16:44 localhost SF-IMS[26192]: [26192] sftunneld:stream_file [INFO] Stream CTX destroyed for 10.252.253.220
Sep 23 16:16:46 localhost SF-IMS[26192]: [26192] sftunneld:sftunnel [INFO] Shutting down after threads exited
Sep 23 16:16:46 localhost SF-IMS[26192]: [26192] sftunneld:sftunnel [INFO] SFTUNNEL is exiting...exit code is: 0
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] Event queue priority: [0]
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Insertion rate: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Dequeue rate: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Average size: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Total inserted: 0
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Total dropped: 0
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] Event queue priority: [1]
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Insertion rate: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Dequeue rate: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Average size: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Total inserted: 0
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Total dropped: 0
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] Event queue priority: [2]
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Insertion rate: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Dequeue rate: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Average size: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Total inserted: 0
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Total dropped: 0
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] Event queue priority: [1]
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Insertion rate: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Dequeue rate: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Average size: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Total inserted: 0
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Total dropped: 0
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] Event queue priority: [2]
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Insertion rate: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Dequeue rate: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Average size: 0.00
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Total inserted: 0
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 	Total dropped: 0
Sep 23 16:16:47 localhost SF-IMS[26192]: [26192] sftunneld:DataMessaging_EventQueue [INFO] 
Sep 23 16:16:47 localhost SF-IMS[3558]: [3558] pm:process [INFO] Process sftunnel (26192) stopped.
Sep 23 16:16:47 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking sfmgr
Sep 23 16:16:47 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking sfipproxy
Sep 23 16:16:47 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking sfmbservice
Sep 23 16:16:47 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking Syncd
Sep 23 16:16:49 localhost SF-IMS[3558]: [3558] pm:process [INFO] Process Syncd (26111) stopped.
Sep 23 16:16:49 localhost SF-IMS[3558]: [3558] pm:log [INFO] Process 'sfmbservice' closed output.
Sep 23 16:16:49 localhost SF-IMS[3558]: [3558] pm:log [INFO] Process 'sfmgr' closed output.
Sep 23 16:16:49 localhost SF-IMS[3558]: [3558] pm:log [INFO] Process 'sftunnel' closed output.
Sep 23 16:16:49 localhost SF-IMS[3558]: [3558] pm:log [INFO] Process 'Syncd' closed output.
Sep 23 16:16:49 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking Syncd
Sep 23 16:16:49 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking sfmbservice
Sep 23 16:16:49 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking sfipproxy
Sep 23 16:16:49 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking sfmgr
Sep 23 16:16:49 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking sftunnel
Sep 23 16:16:49 localhost SF-IMS[3558]: [3558] pm:process [INFO] Started Syncd (27647)
Sep 23 16:16:49 localhost SF-IMS[27647]: [27647] pm:process [INFO] Successfully set oom_score_adj of -200 for process Syncd.
Sep 23 16:16:50 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking SFDataCorrelator
Sep 23 16:16:50 localhost SF-IMS[26760]: [27664] SFDataCorrelator:ControlHandler [INFO] Handling control connection from sudo_user '', cmd '/ngfw/usr/bin/perl /ngfw/usr/local/sf/bin/ActionQueueScrape.pl', pid 27663 (uid 0, gid 0)
Sep 23 16:16:50 localhost SF-IMS[26760]: [27664] SFDataCorrelator:HandleUserMessage [INFO] CHANGE_USER_REREAD_CAPS message
Sep 23 16:16:50 localhost SF-IMS[26760]: [27664] SFDataCorrelator:DataMessaging_URLFilteringLicense [INFO] License disabled/expired or feature disabled
Sep 23 16:16:50 localhost SF-IMS[26760]: [27664] SFDataCorrelator:DataMessaging_URLFilteringLicense [INFO] UnLicensed: URL Filtering feature teardown
Sep 23 16:16:50 localhost SF-IMS[26760]: [27664] SFDataCorrelator:URLUserIP_CorrelatorThread [INFO] urlFiltering feature 2
Sep 23 16:16:50 localhost SF-IMS[26760]: [27664] SFDataCorrelator:url_license [INFO] number of classical URL licenses is 0
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:ControlHandler [INFO] Handling control connection from sudo_user '', cmd '/ngfw/usr/bin/perl /ngfw/usr/local/sf/bin/ActionQueueScrape.pl', pid 27663 (uid 0, gid 0)
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:DCEControl [INFO] DCEControlMessageReconfigure
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:config [INFO] FMC HA is not configured
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:DCEControl [INFO] Pausing Event handlers
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:Correlator [INFO] DomainControl: Initialized 1 domains including 1 netmaps
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:UserIdentity [INFO] user history records: 0, user low records: 5000000, user high records: 5500000
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:Affinity [INFO] File /ngfw/etc/sf/file_capabilities.conf not found on disk
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:Dispatcher [INFO] DCEDispatcherReconfigureAnalyzers calling reconfigure
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:FileExtract [WARN] Failed to retrieve MAC address, model number or model id from EM_peers table
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:FileProcessing [INFO] clear sandbox rate limit
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Archive Stats
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Inspected archives: 0
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Extracted files: 0
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Archive Status Stats
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Encrypted archives: 0
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:ARCHIVE_INSPECT [INFO] MaxDepth archives: 0
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Malformed archives: 0
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:ARCHIVE_INSPECT [INFO] File Type ID Stats
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:ARCHIVE_INSPECT [INFO]   UNKNOWN: 0
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:ARCHIVE_INSPECT [INFO] Sandboxed archives: 0
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:ARCHIVE_INSPECT [INFO] No configuration found. Using defaults instead.
Sep 23 16:16:50 localhost SF-IMS[26760]: [26824] SFDataCorrelator:RabbitMQThread [INFO] No peers file, deleting all RabbitMQ peer objects
Sep 23 16:16:50 localhost SF-IMS[26760]: [26824] SFDataCorrelator:RabbitMQThread [INFO] Connected to 0 Rabbit MQ peers
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:FileProcessing [INFO] FileProcessReconfigure: Preclass Engine Reloaded Successfully
Sep 23 16:16:50 localhost SF-IMS[26760]: [27670] SFDataCorrelator:EventStreamHandler [INFO] Adjusting Event Stream Threads
Sep 23 16:16:50 localhost SF-IMS[26760]: [27009] SFDataCorrelator:EventStreamHandler [ERROR] Unable to establish estreamer connection to 10.252.253.220: Not connected
Sep 23 16:16:50 localhost SF-IMS[26760]: [27009] SFDataCorrelator:EventStreamHandler [INFO] Thread 47240692918016 is being forced to exit
Sep 23 16:16:50 localhost SF-IMS[26760]: [27009] SFDataCorrelator:EventStreamHandler [INFO] Signal:Closing estreamer connection to 10.252.253.220
Sep 23 16:16:50 localhost SF-IMS[26760]: [27009] SFDataCorrelator:EventStreamHandler [INFO] shutting down fp_replication uip follower
Sep 23 16:16:50 localhost SF-IMS[26760]: [27009] SFDataCorrelator:FPReplicationFollower [INFO] shutting down fp replication follower thread with 60 seconds timeout.
Sep 23 16:16:52 localhost SF-IMS[27617]: ConfigFiles.pm:SF::PeerManager::ConfigFiles::create_sftunnel_config [INFO] sftunnel.conf file updated by /ngfw/usr/local/sf/bin/ActionQueueScrape.pl process from /ngfw/usr/local/sf/lib/perl/5.10.1/SF/PeerManager/Registration.pm:649 at Sep 23 16:16:52
Sep 23 16:16:52 localhost SF-IMS[3558]: [3558] pm:process [INFO] HUPing sfmbservice
Sep 23 16:16:52 localhost SF-IMS[3558]: [3558] pm:process [INFO] HUPing sfipproxy
Sep 23 16:16:59 localhost SF-IMS[26760]: [27015] SFDataCorrelator:FPReplicationFollower [INFO] FPReplicationFollower thread exiting consume_message loop.
Sep 23 16:16:59 localhost SF-IMS[26760]: [27019] SFDataCorrelator:RMQClient [WARN] b:ugm:cbfea864-fd16-11ea-8a9d-a3b63850626c failed to open socket: a socket error occurred
Sep 23 16:16:59 localhost SF-IMS[26760]: [27019] SFDataCorrelator:FPReplicationCommunicationRabbit [WARN] unable to establish connection, rval is: 6, attempt number: 1
Sep 23 16:16:59 localhost SF-IMS[26760]: [27009] SFDataCorrelator:FPReplicationFollower [INFO] Follower thread joined.
Sep 23 16:16:59 localhost SF-IMS[26760]: [27009] SFDataCorrelator:FPReplicationFollowerUIP [INFO] shutting down FPReplicationFollowerBase for service: 5000
Sep 23 16:16:59 localhost SF-IMS[26760]: [27009] SFDataCorrelator:EventStreamHandler [INFO] shutting down fp_replication ugm follower
Sep 23 16:16:59 localhost SF-IMS[26760]: [27009] SFDataCorrelator:FPReplicationFollower [INFO] shutting down fp replication follower thread with 60 seconds timeout.
Sep 23 16:17:00 localhost SF-IMS[26760]: [27230] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (e2a0aed0-3108-11e5-966a-af6d2198b5cc), error: Not connected
Sep 23 16:17:02 localhost SF-IMS[3558]: [3558] pm:process [INFO] HUPing Syncd
Sep 23 16:17:02 localhost SF-IMS[27617]: RNAFileCleaner:Util [WARN] Removing all RNA binary files
Sep 23 16:17:03 localhost SF-IMS[3558]: [3558] pm:process [INFO] HUPing sfipproxy
Sep 23 16:17:05 localhost SF-IMS[3558]: [3558] pm:process [INFO] HUPing sftunnel
Sep 23 16:17:05 localhost SF-IMS[27617]: EventHandlerPerl:41 [INFO] EventHandler is not running, skipping SIGNAL (SIGTERM)
Sep 23 16:17:05 localhost SF-IMS[27617]: EventHandlerPerl:117 [INFO] Already cleared /ngfw/var/sf/mabain/metadatastore/
Sep 23 16:17:05 localhost SF-IMS[3558]: [3558] pm:process [INFO] Locking ngfwManager
Sep 23 16:17:06 localhost SF-IMS[3558]: [3558] pm:process [INFO] Process ngfwManager (4241) stopped.
Sep 23 16:17:06 localhost SF-IMS[3558]: [3558] pm:log [INFO] Process 'ngfwManager' closed output.
Sep 23 16:17:06 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking ngfwManager
Sep 23 16:17:06 localhost SF-IMS[3558]: [3558] pm:process [INFO] Started ngfwManager (29373)
Sep 23 16:17:06 localhost SF-IMS[29373]: [29373] pm:process [INFO] Successfully set oom_score_adj of -200 for process ngfwManager.
Sep 23 16:17:09 localhost sudo:     root : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/rm /ngfw/tmp/cd-message-server /ngfw/tmp/cd-message-server-worker
Sep 23 16:17:19 localhost SF-IMS[26760]: [27019] SFDataCorrelator:FPReplicationFollower [INFO] FPReplicationFollower thread exiting consume_message loop.
Sep 23 16:17:19 localhost SF-IMS[26760]: [27009] SFDataCorrelator:FPReplicationFollower [INFO] Follower thread joined.
Sep 23 16:17:19 localhost SF-IMS[26760]: [27009] SFDataCorrelator:FPReplicationFollowerUIP [INFO] shutting down FPReplicationFollowerBase for service: 5001
Sep 23 16:17:19 localhost SF-IMS[26760]: [27670] SFDataCorrelator:DCEControl [INFO] Resuming Event handlers
Sep 23 16:17:19 localhost SF-IMS[26760]: [27670] SFDataCorrelator:DCEControl [INFO] Reconfigure completed successfully
Sep 23 16:17:19 localhost SF-IMS[3558]: [3558] pm:process [INFO] Unlocking SFDataCorrelator
Sep 23 16:17:20 localhost SF-IMS[26760]: [27230] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (e2a0aed0-3108-11e5-966a-af6d2198b5cc), error: Not connected
Sep 23 16:17:40 localhost SF-IMS[26760]: [27230] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (e2a0aed0-3108-11e5-966a-af6d2198b5cc), error: Not connected
Sep 23 16:18:00 localhost SF-IMS[26760]: [27230] SFDataCorrelator:CorrelatorChannelThread [ERROR] Failed to connect to tunnel (e2a0aed0-3108-11e5-966a-af6d2198b5cc), error: Not connected