Sentinel has been active for a long time, reForis indicates functional Threat detection but … ports 21, 22, 23, 25, 80 are closed, HaaS has the last record 2021-11-20 12:28:47 - three days ago. Turning HaaS and minipots on and off brought the required change.
At the same time, I have a scheduled restart for HaaS 17 */12 * * * /etc/init.d/haas-proxy restart
I deduce that the indication of a function is not correct, because it only indicates that the function is enabled and not its real function.
Without checking open ports or HaaS records, an indication of the activity of both functions in reForis is useless. It is strange that even restarting HaaS in a 12-hour cycle did not change its function
So I add preventively 03 */12 * * * /etc/init.d/sentinel-proxy restart