topic Re: Gateway logs locally in Firewall and Security Management

Gateway logs locally

Karel_Mate — Tue, 30 Jan 2024 02:58:03 GMT

Hello,

My client gateway keeps on logging locally even though the connections to the management is never disconnected, We already opened a TAC case but still there is no current solution. We already tried this sk153772, sk114616, but still the logs keeps logging locally, the logs will sometimes sent it to the management and it will comeback to logging locally. The setup is the management server is also a log server. There is no other log server.

Screenshot from the gateway

Screenshot from the management

Screenshot from the HCP result.

Thanks

Re: Gateway logs locally

PhoneBoy — Thu, 01 Feb 2024 06:57:29 GMT

You best bet is to engage the TAC: https://help.checkpoint.com

Re: Gateway logs locally

Machine_Head — Thu, 01 Feb 2024 09:15:47 GMT

Perhaps try disabling logging for some noisy rules like DNS, or check the hit count for heavy rules, and see what happens?

Re: Gateway logs locally

Sven_Glock — Thu, 01 Feb 2024 09:35:03 GMT

I had a similar situation in the past.

The solution was to remove logserver from the gateway config, install policy, add the logserver again and install policy.

Re: Gateway logs locally

Karel_Mate — Thu, 01 Feb 2024 09:53:32 GMT

Will check this one if it work. Thanks.

Re: Gateway logs locally

Karel_Mate — Thu, 01 Feb 2024 09:54:09 GMT

Hi, Sven_Glock, already tried this one but the issue still persist. Thanks.

Re: Gateway logs locally

just13pro — Thu, 01 Feb 2024 10:57:43 GMT

What is your Mgmt & GW version + JHF ?

Had an experience once with similar issue where Mgmt server has lower JHF than the GW.

Once upgraded the JHF for Mgmt Server, it fixed by itself.

Re: Gateway logs locally

Karel_Mate — Mon, 05 Feb 2024 02:39:21 GMT

Hi @just13pro mgmt and gateway is on R81.20 take 26, What version installed on your devices so I can check it also.

Thanks

Re: Gateway logs locally

just13pro — Mon, 05 Feb 2024 05:03:20 GMT

Oh... it might not applicable to your case as mine is GW in Take 26.

Upgraded the Mgmt to Take 41, after rebooted it works itself.

For your case, you might want to take a look this https://support.checkpoint.com/results/sk/sk181068

Re: Gateway logs locally

Karel_Mate — Mon, 05 Feb 2024 05:09:57 GMT

Hi, i see, will try to install the take 41 on all GW and management and see if it will fix the issue, will check also the SK.

Thanks.