Synchronized Application Control: Safely Check Database Issues

If Synchronized Application Control stops detecting new applications, heartbeatd.log reports errors, or a firewall is critically low on storage after an upgrade, the internal application database may be affected. However, this is not a case for generic PostgreSQL commands from a forum or an old support note.

Sophos Firewall manages this data internally and changed its retention behaviour in SFOS 20.0 MR1. If automatic cleanup fails because there is insufficient free storage, the current Sophos documentation explicitly refers administrators to support. This article therefore explains how to safely narrow down the issue, collect the right evidence, and manage a support intervention in a controlled manner.

Classify the Problem Correctly

Synchronized Application Control uses information from endpoints connected to the firewall through Security Heartbeat. This allows the firewall to identify applications that conventional signatures cannot classify unambiguously and makes them available for management under Applications > Synchronized Application Control.

These terms should not be confused:

• Security Heartbeat communicates health and security status between the endpoint, firewall, and Sophos Central.
• Synchronized Application Control records applications and where they were detected on connected endpoints.
• Missing heartbeat describes a missing endpoint status and can be managed using supported Device Console commands.
• An app ID or database issue affects the internal storage of detected applications and requires separate diagnosis.

A missing heartbeat indicator, a red endpoint, or a mismatched firewall rule therefore does not automatically indicate a database issue. To troubleshoot the connection between the firewall and Central, start with Connect Sophos Firewall to Sophos Central.

What SFOS Cleans Up Automatically

The current Sophos documentation for Synchronized Application Control specifies two important limits:

• Synchronized Application Control supports up to 15,000 applications.
• Since SFOS 20.0 MR1, the firewall stores only the five most recent occurrences of each application per endpoint.

When migrating to SFOS 20.0 MR1 or later, the firewall retains the five most recent occurrences and automatically removes older application data. However, Sophos notes that this cleanup may fail when there is insufficient free storage. In this case, Sophos Support should be involved.

For operations, this means that a current firewall does not normally require manual database maintenance for this data. Recurring growth, a failed migration, or an exhausted app ID range are error conditions, not routine maintenance tasks.

Distinguish Typical Symptoms

Storage Issue After an Upgrade

Possible indicators include a heavily used partition, failed reports or services, and a correlation with an upgrade to SFOS 20.0 MR1 or later. This alone does not prove that Synchronized Application Control is the cause.

First check reports, debug logs, support archives, the mail queue, quarantine, and the size of a virtual disk. The process is described in Check Sophos Firewall Storage and Manage Reports.

App ID Range Exhausted

Another symptom is a message such as:

Cannot create ID for application, because appId range is exhausted.
Application will be ignored.

The firewall may continue to display existing applications but can no longer reliably record new ones. This message points to Synchronized Application Control, not to a general report or log database issue.

Security Heartbeat Is Not Working

If endpoints do not report a heartbeat status or rules with heartbeat conditions do not work as expected, first check Central registration, endpoint communication, the affected zones, and the firewall rule. Direct database cleanup is not the correct approach for this issue.

Diagnosis Before Opening a Support Case

1. Document the Firmware and Context

Include the following information in the case notes:

• Firewall model, serial number, and complete SFOS version including the build
• Standalone, HA Primary, or HA Auxiliary
• Date of the most recent upgrade and the previous SFOS version
• Time from which the issue became visible
• Affected services and the specific impact

In HA, it must be clear which node is showing the symptom. Local logs and storage usage can differ between the Primary and Auxiliary.

2. Check the Application View

Under Applications > Synchronized Application Control, check:

• Are new applications still being detected?
• Is the list approaching the limit of 15,000 applications?
• Does the issue affect only new applications or existing entries as well?
• Can applications be searched, opened, and managed?
• Are deleted applications recreated as expected after being detected again?

Deleting individual applications in the interface is a supported function, but it also removes them from Application Filters. If the firewall detects the application again, it reappears. This UI function is therefore not a database repair.

3. Check the Storage Situation Separately

Document storage usage before taking further action. Record the affected partition and the change over time, not just a single percentage value.

If reports, logs, or support archives are deleted at the same time, it will no longer be possible to determine which measure actually helped. Collect evidence first, then make only one change at a time.

4. Collect Logs and the Troubleshooting Report

For Synchronized Application Control and Security Heartbeat, heartbeatd.log is particularly relevant. Also record the exact time of the error and collect a troubleshooting report.

The relevant files and collection methods are described in Sophos Firewall Troubleshooting: Services and Logs and Save Sophos Firewall Logs for External Analysis.

Do Not Adopt Public Database Commands

Various psql, DELETE, VACUUM FULL, and service restart commands for older SFOS versions and different heartbeat issues circulate online. These procedures are not interchangeable:

• A VACUUM FULL frees storage used by a table but does not automatically remove the cause of its growth.
• A DELETE can alter associations between applications, endpoints, or currently authenticated users.
• Tables and support procedures can differ between SFOS versions.
• In HA, the procedure also depends on the node, synchronisation status, and support instructions.

⚠️ Do not make direct changes to the internal PostgreSQL database without current, case-specific instructions from Sophos Support. A configuration backup is important, but it does not provide a complete rollback of the internal database.

Commands from a previous ticket should likewise not be applied to another firewall, firmware version, or HA role without verification. The exact instructions must be included in the current support case and specify the affected node and expected result.

Prepare a Complete Support Case

A well-prepared case accelerates analysis and prevents follow-up questions. Include:

• Complete SFOS version and firewall model
• Serial number and HA role of the affected node
• Time and exact wording of the error message
• Screenshot of Applications > Synchronized Application Control
• Storage usage before any cleanup performed by the administrator
• heartbeatd.log and a troubleshooting report for the relevant period
• Date and path of the most recent firmware upgrade
• Description of whether new applications are missing, storage is low, or both conditions occur

Before a support intervention, make sure a current firewall configuration backup is available. Open a Sophos Support Ticket explains how to create the case.

If support instructs you to perform a database intervention, record the ticket number, approved commands, target node, maintenance window, expected output, and abort criteria in the change. Document and report unexpected error messages instead of experimenting with similar commands.

Verify the System After the Support Action

After the approved action, free storage or successful command output alone is not sufficient. Verify the complete functional path:

1. Open Applications > Synchronized Application Control and check the existing entries.
2. Start a new application that has not previously been detected on a test endpoint.
3. Check whether the application appears and can be managed.
4. Check the Security Heartbeat status of the test endpoint.
5. Test firewall rules with heartbeat or Application Control conditions.
6. Check heartbeatd.log for new errors during the test period.
7. Monitor storage usage over several hours or days.

If the error or growth returns quickly, the cleanup provided only temporary relief. Sophos Support will then need the new timeline, current logs, and information about which action preceded the recurrence.

FAQ