topic Re: Logs migration from old to the new SMS server in Firewall & Security Management

Logs migration from old to the new SMS server

akurtasanov — Wed, 23 Apr 2025 09:50:10 GMT

Good day.

Simple question.

It is enough to simply copy one $FWDIR/log folder from old server to the new for log migration?

P.s. Servers are equal in GAIA version. I know about indexes limitation.

Re: Logs migration from old to the new SMS server

_Val_ — Wed, 23 Apr 2025 10:42:45 GMT

This was discussed multiple times in the community. Please look here: https://community.checkpoint.com/t5/Management/SmartLog-only-look-back-14-days-how-to-reindex-90-days-back/m-p/23280

Re: Logs migration from old to the new SMS server

G_W_Albrecht — Wed, 23 Apr 2025 10:45:38 GMT

Just use migrate_server to migrate SMS including logs:

./migrate_server -v R8xxxx -l /<Full Path>/<Name of Exported File>.tgz

See https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/CLI/migrate_server.htm

Re: Logs migration from old to the new SMS server

the_rock — Wed, 23 Apr 2025 11:49:44 GMT

Hey @akurtasanov

What @G_W_Albrecht said is exactly what you need to do. -l flag is logs without indexing and -x is with.

Andy

Re: Logs migration from old to the new SMS server

Amir_Senn — Wed, 23 Apr 2025 13:00:28 GMT

@akurtasanov

With x it's more recommended. No indexes migrated = need to open log files to search them. Or re-indexing.

Re: Logs migration from old to the new SMS server

the_rock — Wed, 23 Apr 2025 13:14:37 GMT

Good to know!

Andy

Re: Logs migration from old to the new SMS server

akurtasanov — Thu, 24 Apr 2025 04:40:40 GMT

There is one problem.

Not enough free space for full migration.

lv_log total:800 used:627

Will be enough to create fully identical copy of log folder with, like this, command?
rsync -arvP /opt/CPsuite-R81.20/fw/log/ user@host:/opt/CPsuite-R81.20/fw/log/ --delete

Re: Logs migration from old to the new SMS server

the_rock — Thu, 24 Apr 2025 03:18:36 GMT

Try delete some files from /var/log. Example...to check files bigger than 500M -> from expert mode, run -> find /var/log -size +500M

Andy

Re: Logs migration from old to the new SMS server

akurtasanov — Thu, 24 Apr 2025 04:53:58 GMT

There are not so many files. I assume around 10-15 gigs. Not enough.
I would like to avoid the process of increasing free space, but if creating an identical folder on both servers is not enough, then it seems worth going this route.

Re: Logs migration from old to the new SMS server

Amir_Senn — Thu, 24 Apr 2025 07:34:45 GMT

A few points:

You can set logging policy on your log server/ MGMT server. This will do maintenance on your logging by deleting older logs and indexes keeping only the amount of logs/indexes you need (daily maintenance performed on midnight) or by keeping at least X GB of free space on your logging partition (immediately).
Moving the logs manually will not let you search for logs out of the box. Indexer will only index logs files closed on the last 24 hours by default, so you will only have 24 hours of logs in index mode, the rest will be available by manually opening a log file (you can do it in the logs view) or be re-indexing them on the new server.