topic Log report script in Scripts

topic Log report script in Scripts https://community.checkpoint.com/t5/Scripts/Log-report-script/m-p/271455#M1498 Hey guys, This script gives basic info as far as logging rate and any known issues. Lab example: [Expert@CP-GW:0]# cd /var/log/scripts/ [Expert@CP-GW:0]# dos2unix * dos2unix: converting file cp_log_health_report.sh to Unix format ... [Expert@CP-GW:0]# chmod 777 * [Expert@CP-GW:0]# ./cp_log_health_report.sh ===== Check Point Logging Health Report ===== Host : CP-GW Timestamp : 2026-02-20_074729 Requested role : auto Mgmt IP (optional) : (not set) Mgmt Name (optional) : (not set) Disk warning threshold : 85% fw.log growth window : 5s Detected FWDIR : /opt/CPsuite-R82/fw1 Effective role : gw ===== Version / Environment ===== $ fw ver This is Check Point's software version R82 - Build 017 $ uname -a Linux CP-GW 4.18.0-372.9.1cpx86_64 #1 SMP Mon Feb 2 13:41:14 IST 2026 x86_64 x86_64 x86_64 GNU/Linux ===== Process health (WatchDog) ===== $ cpwd_admin list APP PID STAT #START START_TIME MON COMMAND FWK_FORKER 12793 E 1 [07:52:19] 17/2/2026 N fwk_forker FWK_WD 12802 E 1 [07:52:19] 17/2/2026 N fwk_wd -i 6 -i6 0 CPVIEWD 13424 E 1 [07:52:24] 17/2/2026 N cpviewd CVIEWAPIS 13453 E 1 [07:52:24] 17/2/2026 N cpview_api_service CPVIEWS 13460 E 1 [07:52:24] 17/2/2026 N cpview_services SXL_STATD 13473 E 1 [07:52:24] 17/2/2026 N sxl_statd MSGD 13504 E 1 [07:52:25] 17/2/2026 Y msgd CPD 13588 E 1 [07:52:25] 17/2/2026 Y cpd MPDAEMON 13608 E 1 [07:52:25] 17/2/2026 N mpdaemon /opt/CPshrd-R82/log/mpdaemon.elg /opt/CPshrd-R82/conf/mpdaemon.conf TP_CONF_SERVICE 13646 E 1 [07:52:25] 17/2/2026 N tp_conf_service --conf=tp_conf.json --log=info CI_CLEANUP 13785 E 1 [07:52:27] 17/2/2026 N avi_del_tmp_files CIHS 13790 E 1 [07:52:27] 17/2/2026 N ci_http_server -j -f /opt/CPsuite-R82/fw1/conf/cihs.conf FWD 13859 E 1 [07:52:27] 17/2/2026 N fwd SPIKE_DETECTIVE 13887 E 1 [07:52:27] 17/2/2026 N spike_detective RAD 14729 E 1 [07:52:33] 17/2/2026 N rad LPD 15312 E 1 [07:52:38] 17/2/2026 N lpd WSDNSD 17220 E 1 [07:53:36] 17/2/2026 Y wsdnsd DLPU_0 17231 E 1 [07:53:36] 17/2/2026 Y dlpu -i4 0 1 -i6 -1 -1 DLPU_1 17234 E 1 [07:53:36] 17/2/2026 Y dlpu -i4 2 3 -i6 -1 -1 DLPU_2 17237 E 1 [07:53:36] 17/2/2026 Y dlpu -i4 4 5 -i6 -1 -1 TOPOD 17999 E 1 [07:53:43] 17/2/2026 Y topod UPRD 18009 E 1 [07:53:43] 17/2/2026 Y uprd MFDEMUXER 18143 E 1 [07:53:43] 17/2/2026 N /opt/CPcvpn-R82/bin/MoveFileDemuxer /opt/CPcvpn-R82/log/MFDemux.log /opt/CPcvpn-R82/conf/mfdemuxer.C DBWRITER 18146 E 1 [07:53:43] 17/2/2026 N dbwriter /opt/CPcvpn-R82/log/dbwriter.elg /opt/CPcvpn-R82/conf/dbwriter.C CVPNPROC 18149 E 1 [07:53:43] 17/2/2026 N cvpnproc /opt/CPcvpn-R82/log/cvpnproc.elg /opt/CPcvpn-R82/conf/cvpnproc.C MFSERVER 18153 E 1 [07:53:43] 17/2/2026 N /opt/CPcvpn-R82/bin/MoveFileServer /opt/CPcvpn-R82/log/MFServer.log /opt/CPcvpn-R82/conf/mfserver.C CVPNUMD 18161 E 1 [07:53:43] 17/2/2026 N /opt/CPcvpn-R82/bin/CvpnUMD PINGER 18164 E 1 [07:53:43] 17/2/2026 N /opt/CPcvpn-R82/bin/Pinger /opt/CPcvpn-R82/log/Pinger.log /opt/CPcvpn-R82/conf/Pinger.C IDLEPINGER 18167 E 1 [07:53:43] 17/2/2026 N /opt/CPcvpn-R82/bin/IdlePinger /opt/CPcvpn-R82/log/IdlePinger.log /opt/CPcvpn-R82/conf/IdlePinger.C CVPNANALYTICS 18170 E 1 [07:53:43] 17/2/2026 N /opt/CPcvpn-R82/bin/CvpnAnalytics CVPND 18178 E 1 [07:53:44] 17/2/2026 N cvpnd /opt/CPcvpn-R82/log/cvpnd.elg /opt/CPcvpn-R82/conf/cvpnd.C GUACDISPATCHER 18320 E 1 [07:53:45] 17/2/2026 N /opt/CPcvpn-R82/bin/GuacDispatcher /opt/CPcvpn-R82/log/GuacDispatcher.log /opt/CPcvpn-R82/conf/GuacDispatcher.C RTMD 26035 E 1 [07:55:31] 17/2/2026 N rtmd DASERVICE 26102 E 1 [07:55:32] 17/2/2026 N DAService_script AUTOUPDATER 26115 E 1 [07:55:32] 17/2/2026 N AutoUpdaterService.sh PROBEMOND 26133 E 1 [07:55:32] 17/2/2026 N probemond [FAIL] Process FWD is NOT Executing (E) or not present [FAIL] Process CPD is NOT Executing (E) or not present [FAIL] Process FWM is NOT Executing (E) or not present ===== Disk space checks (logging can stop when disk is low) ===== $ df -h Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg_splat-lv_current 50G 13G 38G 26% / /dev/sda2 283M 39M 230M 15% /boot /dev/mapper/vg_splat-lv_log 50G 9.2G 41G 19% /var/log tmpfs 7.6G 36M 7.5G 1% /dev/shm tmpfs 7.6G 0 7.6G 0% /dev/shm_huge cgroup 7.6G 0 7.6G 0% /sys/fs/cgroup $ df -h '/opt/CPsuite-R82/fw1/log' Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg_splat-lv_log 50G 9.2G 41G 19% /var/log [OK] Disk usage for / is 26% [OK] Disk usage for /opt/CPsuite-R82/fw1/log is 19% ===== Gateway checks ===== $ cp_conf sic state Trust State: Trust established ===== masters file (/opt/CPsuite-R82/fw1/conf/masters) ===== $ sed -n '1,120p' '/opt/CPsuite-R82/fw1/conf/masters' [Policy] CP-MANAGEMENT [Log] CP-MANAGEMENT [Alert] CP-MANAGEMENT ===== fw.log growth test (5s window) ===== $ ls -l '/opt/CPsuite-R82/fw1/log/fw.log' -rw-rw---- 1 admin root 8384 Feb 20 00:00 /opt/CPsuite-R82/fw1/log/fw.log [OK] fw.log did not grow in the sample window [INFO] Mgmt IP not supplied; skipping active TCP/257 connection test ===== Recent FWD log errors (tail + pattern scan) ===== $ tail -n 200 '/opt/CPsuite-R82/fw1/log/fwd.elg' | egrep -i 'revoked|certificate|handshake|ssl|connect|refused|timeout|timed out|no route|failed|error' | tail -n 40 || true CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log) for reading failed log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//tracker.log CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//tracker.log CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//tracker.log) for reading failed log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//tracker.log CBinaryFile::ReadHeader: failed to read header CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log) for reading failed log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log pnp_get_blade_data_imp: Failed to get expiration of blade PNP_BLADE_ABOT CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//tracker.log CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//tracker.log CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//tracker.log) for reading failed log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//tracker.log CBinaryFile::ReadHeader: failed to read header CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log) for reading failed log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//tracker.log CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//tracker.log CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//tracker.log) for reading failed log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//tracker.log CBinaryFile::ReadHeader: failed to read header CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log) for reading failed log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log pnp_get_blade_data_imp: Failed to get expiration of blade PNP_BLADE_ABOT CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//tracker.log CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//tracker.log CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//tracker.log) for reading failed log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//tracker.log CBinaryFile::ReadHeader: failed to read header CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log) for reading failed log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log ===== Log connection status (cpstat) ===== $ cpstat fw -f log_connection || true Overall Status: 0 Overall Status Description: Security Gateway is reporting logs as defined Local Logging Mode Description: Logs are written to log server Local Logging Mode Status: 0 Local Logging Sending Rate: 0 Log Handling Rate: 4 Log Servers Connections -------------------------------------------------------- |IP |Status|Status Description |Sending Rate| -------------------------------------------------------- |172.16.10.252| 0|Log-Server Connected| 4| --------------------------------------------------------   ===== Summary / Next steps hints ===== If you saw FAIL/WARN above, common fixes per Check Point guidance include: - Verify disk space on Mgmt/Log Server (df -kh), and adjust log retention if needed. - Ensure Mgmt/Log Server is listening on TCP/257 and the path is reachable end-to-end. - Verify the gateway's 'Logs' settings in SmartConsole and run 'Install Database' if needed. - Confirm SIC trust status and fix/reset SIC if broken. - Confirm /opt/CPsuite-R82/fw1/conf/masters has the correct [Log] server. - If fw.log is corrupted, Check Point suggests moving fw.log* aside and restarting services (cpstop/cpstart). Report saved to : /var/log/cp_log_health_CP-GW_2026-02-20_074729.txt [Expert@CP-GW:0]# Thu, 28 May 2026 07:38:31 GMT the_rock 2026-05-28T07:38:31Z Log report script https://community.checkpoint.com/t5/Scripts/Log-report-script/m-p/271455#M1498 4 Thu, 28 May 2026 07:38:31 GMT https://community.checkpoint.com/t5/Scripts/Log-report-script/m-p/271455#M1498 the_rock 2026-05-28T07:38:31Z