topic Re: Log view problem after upgrade to R81.20 in Firewall and Security Management

Log view problem after upgrade to R81.20

starmen2000 — Wed, 17 Jan 2024 21:56:33 GMT

Hi Mates,

We upgraded the Management Server from R81.10 to R81.20. However, post-upgrade, we observed an issue related to Log view. In order to view logs from before the upgrade, we have to open a specific log file. Consequently, we are unable to see the previous logs without opening a specific log file.

Is this behavior normal, or do we need to take any additional steps to view previous logs without opening a log file?

Thanks

Re: Log view problem after upgrade to R81.20

emmap — Thu, 18 Jan 2024 01:28:56 GMT

If you follow the 'To change log indexing settings' steps from here it should reindex the older log files back as far as you specify,

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_LoggingAndMonitoring_AdminGuide/Content/Topics-LMG/Importing-Offline-Log-Files.htm?tocpath=Getting%20Started%7C_____7

Re: Log view problem after upgrade to R81.20

starmen2000 — Thu, 18 Jan 2024 08:27:02 GMT

Unfortunately it did not help. I think To change log indexing settings affect the system after upgrade, as I see from this sk. https://support.checkpoint.com/results/sk/sk111766 it is also similar issue.

Re: Log view problem after upgrade to R81.20

Amir_Senn — Thu, 18 Jan 2024 12:59:28 GMT

Hi,

No need to change index settings, R81.10 and R81.20 run on same SOLR version so no need to re-index.

Though if you can open log files but see nothing without it, it's 99% indexer issue.

1. If you did an upgrade and your log server is not your MGMT server, please make sure to perform "Install database" operation.

2. You can stop and restart indexer to see if it solves the issue. "stopIndexer ; startIndexer ;"

3. If 1 and 2 doesn't solve the issue, look for errors in $INDEXERDIR/log/log_indexer.elg.

Re: Log view problem after upgrade to R81.20

cem82 — Sat, 10 Feb 2024 09:07:52 GMT

Don't know if it would still apply for R81.20 but have had similar behavior in R81.10 (not after an upgrade) and needed to rebuild the index. It can take a while to rebuild the index though so might pay to test out on a specific log file first https://support.checkpoint.com/results/sk/sk164553

Or what we had to do for all log files

evstop
rm -r $RTDIR/log_indexes/other*
rm -r $RTDIR/log_indexes/audit*
rm -r $RTDIR/log_indexes/firewallandvpn*
rm -r $RTDIR/log_indexes/smartevent*
rm $INDEXERDIR/data/FetchedFiles
evstart

May also check out https://support.checkpoint.com/results/sk/sk167895

Re: Log view problem after upgrade to R81.20

the_rock — Sat, 10 Feb 2024 18:53:23 GMT

I believe it would be the same, correct.

Andy

Re: Log view problem after upgrade to R81.20

Amir_Senn — Mon, 12 Feb 2024 09:35:50 GMT

I wouldn't recommend this unless you're completely certain. This will delete all your indexes which will cause your logs to be unavailable for searching and depending on amount of logs will require resources to re-index them.

Re: Log view problem after upgrade to R81.20

the_rock — Mon, 12 Feb 2024 12:09:34 GMT

What if someone back them up and then copy them over after upgrade? That should work, right?

Andy

Re: Log view problem after upgrade to R81.20

Amir_Senn — Mon, 12 Feb 2024 12:39:27 GMT

IDK, I think it will cause issues. FetchedFiles is what keeps check on what was indexes, if you overwrite it or leave it as it is now, it will create a mismatch. Not sure what will happen.

Re: Log view problem after upgrade to R81.20

the_rock — Mon, 12 Feb 2024 13:31:32 GMT

Ah, gotcha, that makes sense.

Best,

Andy