topic Re: There's no traffic Log in SmartConsole in Firewall & Security Management

There's no traffic Log in SmartConsole

faruq1223 — Thu, 08 Aug 2024 12:47:21 GMT

Dear All,

We faced an issue where there no traffic log in smartconsole

I have Follow this SK to tshoot, everything looks okay
https://support.checkpoint.com/results/sk/sk38848

This is My finding about the issue
1. The issue will solve with install policy. if i make dummy object or rule and install policy the issue solve
2. This is the output from "cpstat mg -f log_server"

3. I found disk issue log issue. login appears during the issue and login is generated at 1 hour interval. need confirmation whether this is the cause of the issue or not.

I need a clue for this issue, I still haven't found why this is happening.

Thanks,

Re: There's no traffic Log in SmartConsole

Lesley — Thu, 08 Aug 2024 21:06:43 GMT

Please share:

SmartConsole -> mgmt object -> Logs -> local storage

I think it gives an error BEFORE it removes old logs. I see many people configure it the other way around

Re: There's no traffic Log in SmartConsole

faruq1223 — Fri, 09 Aug 2024 01:08:55 GMT

Dear Lesley,

I actually noticed that, But is the full disk notification the cause of the loss of traffic logs?
because 1 full day the Log is only like the picture in the post

Thanks,

Re: There's no traffic Log in SmartConsole

the_rock — Fri, 09 Aug 2024 02:34:29 GMT

Run this on the fw, if it shows ANYTHING other than 8.2K, fw is logging locally and thats your issue.

Andy

watch -d ls -lh $FWDIR/log/fw.log (ctrl+c to stop)

If thats the case, then follow below sk to try and solve the problem.

https://support.checkpoint.com/results/sk/sk40090

Re: There's no traffic Log in SmartConsole

faruq1223 — Fri, 09 Aug 2024 03:49:41 GMT

Dear the_rock,

The output showing 8.2K

Thanks,

Re: There's no traffic Log in SmartConsole

the_rock — Fri, 09 Aug 2024 12:52:29 GMT

Thats good then, so might be easy solution as rebooting your mgmt server. Once rebooted, run watch -d $FWDIR/scripts/./cpm_status, wait till shows up and ready, then ctrl+c to stop, then run api status, make sure shows successful, log into smart console and hopefully all the logs will be there.

Let us know.

Andy

Re: There's no traffic Log in SmartConsole

Amir_Senn — Sun, 11 Aug 2024 08:53:30 GMT

If you don't have local logging but you don't see the logs in the logs view you might have an indexing issue.

You can verify it easily by opening a log file manually and see if you see the logs.