topic Re: show logs API timeout reached in Firewall and Security Management

show logs API timeout reached

srinidhi — Thu, 27 Oct 2022 10:51:52 GMT

Hi All,

I am trying to collect logs using API, but when i run the command show-logs, I am not getting any response for long time, and the timeout error occurs. I have tried in management cli, gaia cli and web service http request. But in all the methods I get the timeout error.

these are the commands I am trying

mgmt show-logs new-query.top.count "10"

curl -XPOST "https://x.x.x.x:443/web_api/show_logs" --data-binary "{\"new-query\": {\"time-frame\": \"last-7-days\", \"max-logs-per-request\" : \"2\"}}" -H "Content-Type: application/json" -H "X-chkp-sid: xxxxxx"

I could not see the logs in the smart console even as it fails to connect to the server. but my management server is up and running.

can anyone please let me know how to get the logs using API and in the smart console.

Re: show logs API timeout reached

Chris_Atkinson — Thu, 27 Oct 2022 23:40:58 GMT

Is this a standalone deployment, what setup steps were performed?

Which version is this and what is the output of 'api status' command?

Re: show logs API timeout reached

srinidhi — Fri, 28 Oct 2022 06:54:25 GMT

Yes, This is a Standalone deployment done with ISO image in Network Emulator (EVE-NG)
Version - Checkpoint R81.10 T335
Both Security Management and Gateway Installed.
api status output is successful

Re: show logs API timeout reached

Chris_Atkinson — Fri, 28 Oct 2022 11:29:10 GMT

Have you applied any Jumbo hotfix to the environment?

Re: show logs API timeout reached

PhoneBoy — Fri, 28 Oct 2022 14:31:53 GMT

When I see issues like this, the answer is usually allocate more memory to the VM.
For a small standalone deployment, 8GB is the absolute minimum if SmartEvent isn't used.
With SmartEvent, 16GB is probably more appropriate.

Re: show logs API timeout reached

srinidhi — Sat, 29 Oct 2022 07:13:45 GMT

No, I havent done any

Re: show logs API timeout reached

Chris_Atkinson — Sat, 29 Oct 2022 10:28:11 GMT

Patch it and make sure it has enough resources assigned and let us know how you go from there.

Re: show logs API timeout reached

Tomer_Noy — Sun, 30 Oct 2022 10:19:53 GMT

Another option that might work well for you, if you want to keep the gateway image small, is to manage it from Smart-1 Cloud.

You can opt for a tenant with a license for just 1 gateway. There are many benefits to separating the management from the gateway instance, and Smart-1 Cloud is an easy option that doesn't make you install another machine or VM.

Re: show logs API timeout reached

srinidhi — Sun, 30 Oct 2022 17:58:51 GMT

Thanks, can you please let me know where can I check the current memory allocation which you are referring to.

also I tried to increase the RAM allocation from 8GB to 12GB, but still I can see the smart console fails to connect to the server. I have attached the image for the same. Please let me know where I should be checking for the memory allocations.

Re: show logs API timeout reached

srinidhi — Sun, 30 Oct 2022 18:00:19 GMT

I have assigned 12GB RAM and 80GB storage space to the VM, Please let me know if I need to still increase the memory to access the logs through api and smart console.

Re: show logs API timeout reached

srinidhi — Mon, 31 Oct 2022 06:43:49 GMT

I am able to run the log exporter and get the logs but I am not able to access the show logs api using mgmt_cli or API commands, as it gets timed out. where I can access the other API commands, but only 'show_logs' API is getting timed out.

Please let me know if this is due to Smart event and the configuration.

my current memory configuration is

RAM - 12gb, storage - 80gb, CPU - 2

Here I can see the smartlog server running.

Also I am using the trial license, Please let me know if this license is enough for accessing the logs using the API.

Thanks!

Re: show logs API timeout reached

Chris_Atkinson — Mon, 31 Oct 2022 06:52:19 GMT

Did you apply JHF T78 yet?

Re: show logs API timeout reached

Tomer_Noy — Mon, 31 Oct 2022 06:54:12 GMT

If you cannot see logs in SmartConsole, then it's not an API issue.

Either the machine is severely overloaded (top output might help to see that), or something in the logging configuration is misconfigured.

Re: show logs API timeout reached

srinidhi — Mon, 31 Oct 2022 08:16:51 GMT

I see that there is no issue with the API as I can access other APIs like login, publish or discard.
But I see only 'show logs' API getting timed out. I have tried to query with top 10 records and still getting the same time out error.

Also I can see that the CPU usage is only around 20%

Can you please help me with the proper logging configuration and any other cause for this issue

Re: show logs API timeout reached

srinidhi — Mon, 31 Oct 2022 08:21:32 GMT

can you let me know if this 16GB is the RAM in VM, and if yes, is it mandatory for 16GB RAM to collect logs using API.

Re: show logs API timeout reached

srinidhi — Mon, 31 Oct 2022 08:22:47 GMT

If are unable to see logs in Smart Console,

Will it affect the log viewing through API also ?

As we are getting the same error while trying to view logs through Smart Console and API

Re: show logs API timeout reached

Chris_Atkinson — Mon, 31 Oct 2022 08:41:55 GMT

Is there a reason that you are ignoring the SmartConsole update notification?

Re: show logs API timeout reached

srinidhi — Mon, 31 Oct 2022 09:26:54 GMT

I have installed the Jumbo Hotfix T78

But still I see the issue persisting

Re: show logs API timeout reached

PhoneBoy — Mon, 31 Oct 2022 14:18:22 GMT

16GB is what I recommend generally for performance reasons.
12GB may be fine in a small lab environment.

From your other thread, I see two potential issues: https://community.checkpoint.com/t5/Management/Unable-to-view-logs-in-Smart-Console-for-Version-R81-10/m-p/160787#M32435

The RAM that was allocated when First Time Wizard was run (12GB should be ok)
80GB allocated to VM HDD, which might cause this problem: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk77420

The minimum hardware requirements are listed in the release notes: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RN/Topics-RN/Hardware-Requirements.htm?tocpath=Open%20Server%20Hardware%20Requirements%7C_____1#Minimal_Hardware_Requirements

Having said that, I find decent success (in the lab) with 16GB RAM, 4 Cores, and at least 200GB allocated (again, small lab environment).
You might be able to get away with less, but I'd start there.