Troubleshooting a System Crash or Unexpected Restart
03/26/2020 35 9873
This KB outlines what steps you can take and all the data required for support to resolve a system crash as quickly as possible. If the firewall crashes, or has an unexpected failover it is extremely important to gather as much information as possible about the firewall(s) and provide all the following details to support. Logs are required in order to identify the issue, create a solution and/or develop a firmware patch if necessary to solve the issue. Gathering data is the first step to resolving a system crash and can greatly reduce your time on the phone by uploading these files to your service request prior to calling into support.
Pro tip - Create your case online before calling into support, you will be routed directly to your support queue bypassing customer service and significantly reduce your time on the phone:
How to submit a support case online at MySonicWall.com
A system crash is where the firewall has detected an unrecoverable error and has restarted itself. If the unit is running in high availability a failover will also result. Crashes can result from firmware and settings mismanagement, a misconfiguration, or even a firmware issue that can be addressed by following this article. It's generally best practice to run the latest maintenance or general release of your supported firmware branch in order to avoid system crashes already resolved in updated releases.
More on firmware and settings management:
How to Understand and Resolve Settings Corruption
Can Settings be Exported/Imported from one SonicWall to Another? (Support Matrix)
In the event of a system crash gather the following items and upload them to your service request. If web access isn't available through your usual web interface try plugging directly into the MGMT interface if available. A restart may be required to gain web access. If web access is still not available, and you cannot restart, these files can be gathered via ssh or console access as a last resort.
Follow this link if you are not sure how to download these files:
How to gather required logs from your SonicWall
1) Download Tech Support Report (TSR) - Provides support firmware, settings history, configuration and diagnostic details
2) Download Settings File - Provides more configuration details and ability to troubleshoot in and lab environment
3) Download GUI Logs - Provides network events you set to log in the GUI for diagnostic purposes. This log is cleared if there is a restart, and will resume collecting data after a restart.
4) Download Current + All Trace Logs - These are some of the most indispensable sources of information to gather if the firewall crashes. Support can decrypt stack traces for diagnosing the root cause of the issue. Support cannot define trace logs for customers, these are meant for internal development diagnostic purposes. Stack traces are generally the result of a firmware issue that can be resolved with maintenance release firmware or a hotfix.
5) Provide the date(s) and best known time(s) of the event in the service request description
6) Upload all of the requested files to your service request, follow this link if you're not sure how:
How to upload or download support files through your service request
If the units are running in high availability the same files are required from both units. Files from standby unit alone are not sufficient when only the active unit has crashed.
Support may request to temporarily disable certain features while the service request is open until a misconfiguration, or firmware issue can be addressed and the case is resolved. For example if it's known high core zero load is causing a crash or preventing web access, certain features that utilize core zero may need to be temporarily disabled, or a restart may be required to temporarily gain web access until suggested changes are made.
More on Core Zero:
How to Troubleshoot Core 0 Spikes or High Utilization