topic Re: Checkpoint R81.20 Logging Issue in Firewall and Security Management

Checkpoint R81.20 Logging Issue

SuchitSrivastav — Sat, 17 Dec 2022 19:21:46 GMT

Hi CheckMates,

I have recently upgraded my Checkpoint Management Server from R80.30 to R81.20. So far, things looks good but I've started facing issue with Logging. When I open Logs&Monitor tab, in Logs I'm not able to see the Logs itself. To see the logs I've to open the specific log file. I've enabled log indexing etc. and my logging partition has more than 2TB space that should not be something with space.

I've detached & attached the log server from multiple gateways, just for testing purpose but no luck.

Any leads can suggest urgently if you've seen such issues? I've logged a TAC case but they told me this is something new issue for them too with R81.20.

PS: I'm aware that old log index wouldn't be upgraded in R81.x. I'm referring here about new log files that is being created post upgrade.

Thank you!!

Re: Checkpoint R81.20 Logging Issue

Chris_Atkinson — Sun, 18 Dec 2022 00:14:38 GMT

Do you see any logs or report data at all post upgrade?

Does same issue continue if you do evstop; evstart on the node with smartevent enabled?

Re: Checkpoint R81.20 Logging Issue

SuchitSrivastav — Sun, 18 Dec 2022 00:25:36 GMT

No, I didn't see any logs post upgrade. Ran these commands but no luck. When I try in SmartView, it just says "Query Failed" for running any queries or reports.

Re: Checkpoint R81.20 Logging Issue

Chris_Atkinson — Sun, 18 Dec 2022 00:33:44 GMT

Is the machine still under considerable load from the indexing, how much resources are allocated to the system?

Suspect this will be something that you will need to continue working on with TAC who will raised a task with R&D where required.

Re: Checkpoint R81.20 Logging Issue

SuchitSrivastav — Sun, 18 Dec 2022 00:37:34 GMT

My machine has 32 GB RAM with 8 CPU and 3TB Hard Disk. Resources are enough I think. I had logged a case with TAC but this is something new for them as well.

Re: Checkpoint R81.20 Logging Issue

Chris_Atkinson — Sun, 18 Dec 2022 01:02:50 GMT

CPU utilisation isn't high?

Please update us as the TAC case progresses and report back here with the final resolution.

Re: Checkpoint R81.20 Logging Issue

SuchitSrivastav — Sun, 18 Dec 2022 01:05:10 GMT

CPU is fine. Will keep posted here as soon as I've any update from them.

Re: Checkpoint R81.20 Logging Issue

the_rock — Sun, 18 Dec 2022 03:07:40 GMT

Just as a workaround for now...sorry, Im typing this on my Iphone, as I dont have access to my laptop, but what you can do is go to c/program files x86/check point/smart console R81.20 and then look for cplvg i believe (its a green-ish) icon and that will open old fashioned tracker.

See if logs are there. If yes, then could be indexing issue. If not, could be way bigger issue...

Re: Checkpoint R81.20 Logging Issue

Liat_Cihan — Sun, 18 Dec 2022 08:26:33 GMT

Hi,

Can you please share the SR number?

Re: Checkpoint R81.20 Logging Issue

the_rock — Sun, 18 Dec 2022 12:18:06 GMT

@SuchitSrivastav , you are covered now, @Liat_Cihan is great!

Re: Checkpoint R81.20 Logging Issue

genisis__ — Sun, 18 Dec 2022 16:47:55 GMT

Question:

When you say you do not see any logs after upgrading, did you confirm the following:

- Policy push to GWs was done after upgrade, and clearly confirm if SIC is working (it should be).

- Install database was done to all Management Layer devices.

- If above is done, fire up SmartView Tracker (yes Tracker), and confirm if you see any logs in this. If you do then the issue is not logging from GWs to the SMS, but the SMS taking the raw logs and then indexing them.

Re: Checkpoint R81.20 Logging Issue

SuchitSrivastav — Tue, 20 Dec 2022 17:14:34 GMT

SR#6-0003428171, here you go.

Re: Checkpoint R81.20 Logging Issue

SuchitSrivastav — Tue, 20 Dec 2022 17:19:38 GMT

Yes, as I said in my first post, I can see the logs when selecting the specific log files. Verfied in SmartConsole's log&monitor as well as old fashioned SmartView Tracker.

SIC etc. are fine, I've checked this post upgrade and installed the policies on all gateways what I've configured with SMS.

Indexing is also configured and tested. It works well and same has been verified by TAC too.

Please suggest if we've better way to fix this? I'm afraid as this is my production environment. 😞

Re: Checkpoint R81.20 Logging Issue

Ilya_Yusupov — Tue, 20 Dec 2022 18:34:21 GMT

Hi @SuchitSrivastav ,

Just to clarify the case here, the issue is post upgrade you do see new logs but it's shown like empty list in the view itself and when you click on one raw the log details are seen.

Is the above correct?

Thanks,

Ilya

Re: Checkpoint R81.20 Logging Issue

SuchitSrivastav — Tue, 20 Dec 2022 18:58:13 GMT

Yes that's right.

Re: Checkpoint R81.20 Logging Issue

the_rock — Tue, 20 Dec 2022 19:04:06 GMT

You are in good hands now, when @Ilya_Yusupov comes to the rescue, trust me, stuff gets FIXED 100%!

Re: Checkpoint R81.20 Logging Issue

SuchitSrivastav — Tue, 20 Dec 2022 19:06:50 GMT

Thank you Rock.. Hope we can fix this on urgent basis as my production is getting hamppered.

PS: TAC is asking to grab some debug logs but I don't think that should be needed actually. I can see in tcpdump that port 257 is listening and logs are perfectly coming on management server from all of configured gateways.

Re: Checkpoint R81.20 Logging Issue

Ilya_Yusupov — Tue, 20 Dec 2022 19:15:44 GMT

@SuchitSrivastav - thank you, let me clarify couple of things tomorrow with my colleagues before me suggesting a solution.

I will update here tomorrow.

Re: Checkpoint R81.20 Logging Issue

SuchitSrivastav — Tue, 20 Dec 2022 19:19:31 GMT

Thank you so much. I'll be back tomorrow about 8 PM IST.

Re: Checkpoint R81.20 Logging Issue

the_rock — Tue, 20 Dec 2022 19:20:37 GMT

People who know me know that I do NOT say things like that about anyone, unless I mean them 100%. @Ilya_Yusupov fixed ISP redundancy issue for my colleague and I and let me tell you, it was very DIFFICULT problem, so I have full confidence he will do same for you as well. Just give him little bit of time, he is super smart and very responsive.