https://community.checkpoint.com/t5/Firewall-Security-Management/R81-SmartLog-Attempting-to-Read-From-Incorrect-Log-Server/m-p/136651#M73545 <P>TAC has been no help so far, so wondering if anybody else has run into this.</P><P>Upgraded management/dedicated log server/dedicated smart event serverfrom R80.40 to R81.&nbsp; Since then, Management is attempting to read logs from a non-existent log server.&nbsp; DENEWARDOFW1 is a Security Gateway and does not have the logging blade enabled.&nbsp; There are no log files on SmartLog from this gateway and checked every single object and no objects have it set as a log server.&nbsp; Not sure why this is even showing up.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="logging.png" style="width: 357px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/14604iE02922E76C792D69/image-size/large?v=v2&amp;px=999" role="button" title="logging.png" alt="logging.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="blades.png" style="width: 572px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/14601iADEF57136A893B30/image-size/large?v=v2&amp;px=999" role="button" title="blades.png" alt="blades.png" /></span></P><P>&nbsp;</P><P>If I don't disable DENEWARDOFW1 in the logging and monitor tab, I get "requested object not found" with no logs.&nbsp; It seems it's defaulting to this "log server" as the Smartlog on the rules themselves get the same error.&nbsp; Everything works fine on the logging and monitor tab if I disable DENEWARDOFW1.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="log_server.png" style="width: 277px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/14603iCA26DCA1A8F84A29/image-size/large?v=v2&amp;px=999" role="button" title="log_server.png" alt="log_server.png" /></span></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="logerror.png" style="width: 999px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/14602i5864AA8BDF897C22/image-size/large?v=v2&amp;px=999" role="button" title="logerror.png" alt="logerror.png" /></span></P> Fri, 17 Dec 2021 14:39:10 GMT n3treaper 2021-12-17T14:39:10Z https://community.checkpoint.com/t5/Firewall-Security-Management/R81-SmartLog-Attempting-to-Read-From-Incorrect-Log-Server/m-p/136651#M73545 <P>TAC has been no help so far, so wondering if anybody else has run into this.</P><P>Upgraded management/dedicated log server/dedicated smart event serverfrom R80.40 to R81.&nbsp; Since then, Management is attempting to read logs from a non-existent log server.&nbsp; DENEWARDOFW1 is a Security Gateway and does not have the logging blade enabled.&nbsp; There are no log files on SmartLog from this gateway and checked every single object and no objects have it set as a log server.&nbsp; Not sure why this is even showing up.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="logging.png" style="width: 357px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/14604iE02922E76C792D69/image-size/large?v=v2&amp;px=999" role="button" title="logging.png" alt="logging.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="blades.png" style="width: 572px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/14601iADEF57136A893B30/image-size/large?v=v2&amp;px=999" role="button" title="blades.png" alt="blades.png" /></span></P><P>&nbsp;</P><P>If I don't disable DENEWARDOFW1 in the logging and monitor tab, I get "requested object not found" with no logs.&nbsp; It seems it's defaulting to this "log server" as the Smartlog on the rules themselves get the same error.&nbsp; Everything works fine on the logging and monitor tab if I disable DENEWARDOFW1.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="log_server.png" style="width: 277px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/14603iCA26DCA1A8F84A29/image-size/large?v=v2&amp;px=999" role="button" title="log_server.png" alt="log_server.png" /></span></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="logerror.png" style="width: 999px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/14602i5864AA8BDF897C22/image-size/large?v=v2&amp;px=999" role="button" title="logerror.png" alt="logerror.png" /></span></P> Fri, 17 Dec 2021 14:39:10 GMT https://community.checkpoint.com/t5/Firewall-Security-Management/R81-SmartLog-Attempting-to-Read-From-Incorrect-Log-Server/m-p/136651#M73545 n3treaper 2021-12-17T14:39:10Z https://community.checkpoint.com/t5/Firewall-Security-Management/R81-SmartLog-Attempting-to-Read-From-Incorrect-Log-Server/m-p/136763#M73546 <P>1) Logging should definitely be off on the security GW itself</P> <P>2) Make sure to use the install database command on all the servers post upgrade.</P> <P>3) If the other stuff won't help, please try to restart the indexer on your servers with " stopIndexer ; startIndexer "</P> Sun, 19 Dec 2021 06:50:21 GMT https://community.checkpoint.com/t5/Firewall-Security-Management/R81-SmartLog-Attempting-to-Read-From-Incorrect-Log-Server/m-p/136763#M73546 Amir_Senn 2021-12-19T06:50:21Z