How can I determine what causes an obscure event log health check warning?

Products

• ProxySG Software - SGOS

Issue/Introduction

On occasion, the ProxySG appliance may generate an event log warning that does not seem to provide any information about the cause of the warning. For example: 

 "Health Monitor (WARNING): Health Check Status is 'WARNING'"  1 6F0101:1 Mailed notifier.cpp:125

You can refer to the ProxySG appliance Sysinfo (https://<IP_address>:<port>/Sysinfo) to investigate the cause of the warning.

Example of Using Sysinfo statistics to determine cause of health check warning

Use the following as a guideline for steps to take to determine the cause of the issue:

1. In Sysinfo, go to the /Monitor/Statistics section.
2. Refer to the list of Health Check Statuses. The Networking section is the only area that lists health checks without any description; these health checks are for DNS, ICAP, Forwarding hosts, and more.
   The following shows the last transition in the /Monitor/Statistics section:

   Stat: Health Check Status

   Current State                 : OK
   Last Transition               : Sat, 09 Feb 2013 02:33:12 UTC
   Current Value                 : OK
   Notification Method           : log, mail
    
3. Go to the /health_check/statistics section for all of the networking-related checks. 
4. Look for a check that lists a failure that matches the time listed in the last transition found in the /Monitor/Statistics section:
     fwd    Domain name: 208.93.133.75

      IP address: 208.90.132.70                 Enabled         OK      UP

        Last status: Success.

        Successes (total): 44759        (last): Sat, 09 Feb 2013 03:11:15 GMT   (consecutive): 228

        Failures (total): 15   (last): Sat, 09 Feb 2013 02:33:01 GMT   (consecutive): 0        (external): 0

        Last response time: 44 ms       Average response time: 45 ms

        Minimum response time: 44 ms    Maximum response time: 60 ms

Using these two entries, you can determine that the health check warning originates from a bad connection to a forwarding host. For more details, investigate the connections between the appliance and the forwarding host.

You can also use packet captures (PCAPs) to troubleshoot further.