USG FLEX 500H - Logs broken AGAIN

Mk88_it

Hello, the logs on our 500H are broken again, even with the latest firmware 1.35(ABZH.2) as you can see in the following picture

There is also a previous question tha has already been answered by @Zyxel_Judy
V1.32 500H: the logs are broken — Zyxel Community

PeterUK

Logs and time seems fine here can you check in USG system > settings the time is correct to windows?

I also use windows as a time server for my USG

ConfigureNTP Server in Windows Server 2019/2022 | ComputingForGeeks

You will also need this set on the USG by SSH

edit running

vrf main ntp maxdistance 16

commit

copy running startup

Mk88_it

@PeterUK The logs and time aren't fine unfortunately…. The logs are stopped since one day after the last boot of the device

We had the same issue with firmware version 1.32 too

PeterUK

Seems fine here like I said time matches in real time

I suggest you test setting up windows as a NTP server and see if that makes difference?

I know that with these FLEX H they send logs to nebula maybe your not linking to the servers correctly and its causing a problem? I know that I'm in a case where the USG fail to connect to server sometimes.

Do you have many WAN IP uplinks?

Mk88_it

I don't know why, but the logs feature is completely stopped on our device. I don't think it's a problem about NTP or wan config

No logs are sent to Nebula or SecuReporter either.

I know how to solve the situation: reboot the device as usual 😫

@Zyxel_Melen @Zyxel_Judy Would you like to investigate this issue? If not, I will have to reboot the device….

Zyxel_Melen

Hi @Mk88_it

PM sent. Please help to provide the org and site name and enable Zyxel support. Thanks!

PeterUK

One thing I'm doing different to most people is the following:

make group with the following FQDN

*.myzyxel.com
*.zyxel.com

then make a routeing rule

incoming Zywall

Destination Address FQDN group you made

nexp hop your WAN interface

SNAT none

then reboot see if that fixes it

Dylan96

I don't think this solution is relevant to the problem described.

PeterUK

https://community.zyxel.com/en/discussion/comment/80554#Comment_80554

Well it still the fact that I don't see this problem so must be doing something different if the USG is not connecting to Nebula maybe thats the reason why log locally are not happening in time.

Mk88_it

I think it's something related to device insight function

PeterUK

https://community.zyxel.com/en/discussion/comment/80556#Comment_80556

well I do have that disabled so you might be right?