UTM Data Sources Disconnected

[Pro-Tri]

A few days ago UTM alerted us that it was running out of storage space for storing logs. A day after which UTM stopped collecting all logs. Turns out we had allocated more than enough storage but for some reason the disk was displaying less than half its storage. After the resizing the volume the storage warning went way.
We had hoped that resolving the storage issue would restart log collection but we cant see any logs within log explorer. Our data sources are also displaying as disconnected.

Also checked the service logs using "docker service logs utmstack_log-auth-proxy", received the error in the screenshot below. Not sure if its related to the issue above.

We haven't tried to reinstall the agents yet. Any guidance to help troubleshoot the issue would be appreciated.
UTM is installed on Ubuntu 22.04.5 LTS.

Thanks

[karlbrown87]

Hi @Pro-Tri

Thank you for reaching out and providing us with the details regarding the issue you're experiencing with UTMStack.

To assist you further, we kindly request that you send us a screenshot of the result from the docker stats command in your environment. This will help us analyze the current state of the resources and the performance of the containers.

Additionally, could you please let us know which version of UTMStack you are currently using?

Update Recommendation: We recommend updating to the latest version of UTMStack. For versions earlier than v10.6.0, we suggest performing a direct update to the latest version (currently v10.7.2) to benefit from the significant improvements introduced in the recent releases. Below, we have outlined some key improvements in versions v10.7.0, v10.7.1, and v10.7.2 that can greatly enhance the performance of the application, as well as other added features:

UTMStack 10.7.0, 10.7.1, 10.7.2 Release Notes:

Bug Fixes:

• Resolved responsive text alignment issues for action buttons in the Log Explorer to ensure visual consistency.
• Fixed an issue with loading data from saved queries in the Log Explorer, ensuring that filter values are applied correctly.
• Addressed a problem where tabs remained open when navigating outside the Log Explorer scope, improving the user experience.
• Fixed a time filter issue where the selected date range was not applied correctly.
• New Features and Improvements:
• Added the organization name in the app settings to improve clarity in alert and notification emails.
• Significant improvement in CPU performance.
• Enhanced the email notification system by including the organization name for better recipient identification.
• Introduced new compliance reports aligned with PCI DSS standards, expanding auditing capabilities.
• Added new menu items: New Dashboard and New Visualization.
• Agent & Collector Dependencies: Agents and collectors now retrieve their dependencies from the agent manager, ensuring centralized dependency management and improved consistency.
• Agent Installation: Enhanced installation messages to provide clearer guidance during the setup process.
• Agent Service Cleanup: Removed unnecessary services to streamline system performance and reduce overhead.
• Error Recovery: Improved agent stability and fault tolerance by enhancing recovery from specific data streaming errors when interacting with the agent manager.
• Debug Mode for Agents: Introduced a debug mode for agents, allowing better troubleshooting and logging.
• Certificate Verification Improvements: Strengthened certificate verification mechanisms in agents to enhance security and prevent connection issues.
• Windows ARM64 Agent Support: Added support for Windows ARM64 agents, expanding compatibility across architectures.

Breaking Changes:

• Additional Port Requirement: Along with ports 50051 and 9000, port 9001 is now required for downloading dependencies. Please ensure this port is open to maintain proper agent and collector functionality.

Best Regards,
Carlos

[Pro-Tri]

Thanks for the reply, we managed to get it to work after reinstalling the agents. We are currently on version 10.5.18.