topic Re: Smart-1 600-S server acting as main log server in Firewall and Security Management

Smart-1 600-S server acting as main log server

Joe_Kanaszka — Thu, 26 Sep 2024 15:14:46 GMT

Morning all!

Running R81.20 Take 53

2 node active/standby cluster

SmartEvent (log server) running on a Smart-1 600-S appliance

Management server is running in a VM (backup log server)

2 questions.

I've recently been looking at my log settings as I'm seeing a pop-up in SmartConsole that my /opt partition is under 2GBs. I don't know where this alert is referring to as I've checked my disks using df -h and also looked at the system information information in SmartView Monitor...
If I look at $FWDIR/log on both of my security gateways, I'm seeing a ton of logs like this:

Aug 2 23:59 2024-08-03_235900.logaccount_ptr
Aug 2 23:59 2024-08-03_235900.loginitial_ptr

Why are these logs being stored here and ALSO on my log server?

Thanks guys

Here are some additional issues I may have found:

I've looked in the R81.20 admin guide for configuring logging and found this article - but I do not see the options it is describing:

Also It does not appear I'm forwarding the logs from my gateways even though I'm seeing the logs on my two log servers...

Re: Smart-1 600-S server acting as main log server

Amir_Senn — Thu, 26 Sep 2024 15:04:52 GMT

Hi,

1. Would check on both SMS and on log server/SmartEvent

2. You might have local logging at time. This could be caused of servers are not available, connectivity issues, heavy load of logs etc. To solve this, I would go to all gateways/clusters objects you have, go to Logs -> Additional Logging , in there activate log forwarding to your log server and select a time for this. This should take care of this.

Re: Smart-1 600-S server acting as main log server

Joe_Kanaszka — Thu, 26 Sep 2024 15:23:16 GMT

Thank you Amir.! Please do me a favor a take a look at my screenshots above. In the second screenshot it says "Send a copy..."

So does this mean that the logs are stored on the security servers and the log server?

Re: Smart-1 600-S server acting as main log server

the_rock — Thu, 26 Sep 2024 15:44:42 GMT

Hey brother, thats exactly what it means, yup.

Andy

Re: Smart-1 600-S server acting as main log server

Joe_Kanaszka — Thu, 26 Sep 2024 15:52:57 GMT

Thanks Andy! So what's the point of having a log server if the logs are going to be stored on the gateway anyway?

Sorry - here's the screenshot I was referring to from my cluster object:

Re: Smart-1 600-S server acting as main log server

the_rock — Thu, 26 Sep 2024 15:54:02 GMT

Hey Joe,

So one way to be 100% positive fw is NOT logging locally is below command.

watch -d ls -lh $FWDIR/log/fw.log (ctrl+c to stop)

Leave it for 30 seconds or minute or so, if it stays at 8.2K, that without any doubt proves its NOT logging locally, but to the log server.

Andy

Re: Smart-1 600-S server acting as main log server

Joe_Kanaszka — Thu, 26 Sep 2024 16:11:08 GMT

Thanks Andy - my fw.log file on my security GW is at 8.3K. (I didn't stop using the command)

Why do I have all these old .log, .logaccount_ptr, and loginitial_ptr files on my security GWs?

Aug 25 23:59 2024-08-25_235900.log

Aug 24 23:59 2024-08-25_235900.logaccount_ptr

Aug 24 23:59 2024-08-25_235900.loginitial_ptr

Re: Smart-1 600-S server acting as main log server

the_rock — Thu, 26 Sep 2024 16:13:31 GMT

Is it in same dir? $FWDIR/log?

Re: Smart-1 600-S server acting as main log server

Joe_Kanaszka — Thu, 26 Sep 2024 16:18:08 GMT

Yes.

/opt/CPsuite-R81.20/fw1/log

Re: Smart-1 600-S server acting as main log server

the_rock — Fri, 27 Sep 2024 01:21:20 GMT

I have bunch of those as well. But, my fw.log file ALWAYS shows 8.2 K, which tells me 100% its NOT logging locally, otherwise, that file would be growing rapidly.

Andy

Re: Smart-1 600-S server acting as main log server

Joe_Kanaszka — Fri, 27 Sep 2024 11:53:51 GMT

Morning Andy - Happy Friday! A follow up question...

I'm seeing this pop-up every day now. What device is this coming from and how can I find out perhaps using df -h or du -h?

I can't seem to find the linux command to get me the free space on a directory - in this case /opt.

Re: Smart-1 600-S server acting as main log server

the_rock — Fri, 27 Sep 2024 12:07:50 GMT

Hey brother,

No problem man, questions are free, answers may cost money...I charge 5 easy payments of ONLY 49.99$ 😉

Just kidding, of course you can ask as many questions!

Anywho, here is how you "tackle" this...

So, since we are talking /opt, do something like this from expert mode:

find /opt -size +300M

That will look for any files bigger than 300MBs and of course, you can replace 3 with any other digit.

Here is example in my lab.

Andy

Btw, just for the context, IF you see any of below files, do NOT delete them, as anything jumbo related in sub dir LastTake is needed to install further jumbo fixes.

[Expert@CP-GW:0]# find /opt -size +300M
/opt/CPda/backup/CheckPoint#CPUpdates#All#6.0#5#4#BUNDLE_R81_20_JUMBO_HF_MAIN#79/LastTake/fw1_backup_HOTFIX_R81_20_JUMBO_HF_MAIN.tgz
/opt/CPda/backup/CheckPoint#CPUpdates#All#6.0#5#4#BUNDLE_R81_20_JUMBO_HF_MAIN#84/LastTake/fw1_backup_HOTFIX_R81_20_JUMBO_HF_MAIN.tgz
/opt/CPda/backup/CheckPoint#CPUpdates#All#6.0#5#4#BUNDLE_R81_20_JUMBO_HF_MAIN#84/Completely/fw1_backup_HOTFIX_R81_20_JUMBO_HF_MAIN.tgz
[Expert@CP-GW:0]#

Re: Smart-1 600-S server acting as main log server

Joe_Kanaszka — Fri, 27 Sep 2024 12:24:10 GMT

Thanks Andy!

So as far as that message I'm receiving when I open SmartConsole talking about having less than 2GB of free disk space on /opt...is there no way to tell which device is reporting this without searching via command line all my devices?

Also is there a way to find the "free disk" space of a partition (/opt)? My "GoogleFu"v is failing me lol!

Thanks again Andy

Re: Smart-1 600-S server acting as main log server

the_rock — Fri, 27 Sep 2024 12:29:16 GMT

Um, good question...not sure about smart console, might be hard to tell unless maybe from "old school" sv monitor, otherwise, it would pop up 100% when you log into web UI, for sure.

You cant really tell "free disk" portion, hehe. You need to do search similar to one I sent you.

Or, you can do below.

Andy

du -h /opt | sort -h

Re: Smart-1 600-S server acting as main log server

Joe_Kanaszka — Fri, 27 Sep 2024 12:39:44 GMT

Cool. Thanks again man - have a good weekend!

Re: Smart-1 600-S server acting as main log server

the_rock — Fri, 27 Sep 2024 12:57:58 GMT

Did that help? Btw, you can open old school sv monitor from c/programfilesx86/checkpoint/R81.xx/program (I think) and then look for SVmonitor icon (I believe its sort of orangy color). Or just log into web UI and see which device shows it.

Nice weekend as well!

Andy

Re: Smart-1 600-S server acting as main log server

the_rock — Fri, 27 Sep 2024 13:13:58 GMT

Hey Joe,

Just to help you further, I attached some screenshots about what I was referring to, you can also tell this way.

Andy

Re: Smart-1 600-S server acting as main log server

Joe_Kanaszka — Fri, 27 Sep 2024 13:59:35 GMT

Thanks Andy - you're talking about SmartView Monitor right?

Re: Smart-1 600-S server acting as main log server

the_rock — Fri, 27 Sep 2024 14:00:23 GMT

You got it.

Re: Smart-1 600-S server acting as main log server

Joe_Kanaszka — Fri, 27 Sep 2024 14:00:37 GMT

That's what I thought. Thanks again Andy!