SSG140 suddenly restarted

[sh]

Hello

I have experianced a new issue in SSG140, it was suddenly restarted. Following are the logs kindly help and advice what happen to SSG140. Thanks

2008-11-11 09:42:28

notif The physical state of interface ethernet0/1 has changed to Up.

2008-11-11 09:42:09

info Rapid Deployment cannot start because gateway has undergone configuration changes.

2008-11-11 09:42:09

notif System was reset at 2001-03-09 22:46:55 by netscreen

2008-11-11 09:42:09

notif System is operational.

2008-11-11 09:42:01

notif The physical state of interface ethernet0/2 has changed to Up.

2008-11-11 09:42:01

notif The physical state of interface ethernet0/5 has changed to Up.

2008-11-11 09:42:01

notif The physical state of interface ethernet0/3 has changed to Up.

2008-11-11 09:42:01

notif The physical state of interface ethernet0/4 has changed to Up.

2008-11-11 09:41:58

alert SCCP ALG enabled on the device.

2008-11-11 09:41:58

alert SCCP ALG registered line break to tcp-proxy

[Raheel]

these log messages captured before SSG got restarted?

if not can you please paste full log.

thanks

Raheel Anwar

[Nadia]

If you experienced a crash on the device, I would recommend opening a JTAC case and supplying a "get tech" together with "get log sys saved" in order to find the cause.

Thanks,

Nadia

[sh]

Hello Nadia

I got the "get tech" but i can not get "get log sys saved", i think logs are gone. kindly advise, thanks

[Arkus · Accepted solution]

Hi sh,

If there is nothing in the "get log system saved" are you sure that the system crashed? When the firewall crashes, a snippet of the crash is almost always saved in the log. If the log is empty, that would indicate that the system did not crash. The eventlog contains:

2008-11-11 09:42:09

notif System was reset at 2001-03-09 22:46:55 by netscreen

(you need to set the date and time on your firewall)

This means that it could've been reset by a user. For example, if I reset my firewall:

2008-11-11 21:29:28 system notif 00767 System was reset at 2008-11-11 21:28:
                                       05 by netscreen

If there is nothing in the log, and you believe that this was a crash, then you need to hook a PC into the console port and leave it there. If there is another crash, then the full crash trace can be submitted to JTAC.

Regards,

A.

[sh]

Hello Arkus

Thanks for the help, I really appriciate. Once again thanks.

With best regards

Sufyan Ali Shaikh

Network Engineer

JNCIA-ER, JNCIA-EX, JNCIA-FWV, JNCIA-WX