topic Re: Log-server Disconnected in Firewall and Security Management

Log-server Disconnected

Blason_R — Fri, 03 Sep 2021 05:11:06 GMT

Hi Team,

I am facing this weird issue; I upgraded my hardware from 4000 series to 6000 series and upgraded versions as well. My management server was already upgarded and recently I upgraded hardware of firewall as well as version from R77.30 to R80.40.

However after upgradation my logs are completely stopped and here is I am getting in fwd.elg

[FWD 17769]@xxx-CPFW_02[3 Sep 10:36:30] 10:36:30: srv_disconnected: change xx.xx.10.2 status to Status ERROR description: Log-Server Disconnected
log_connected: connect to '192.168.10.2' failed
[FWD 17769]@xxx-CPFW_02[3 Sep 10:37:35] 10:37:35: srv_disconnected: change xx.xx.10.2 status to Status ERROR description: Log-Server Disconnected

Re: Log-server Disconnected

Tal_Paz-Fridman — Fri, 03 Sep 2021 12:04:34 GMT

Perhaps this might help (even if the issue seems a bit different):

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk172086

Basically, perform Install Database on the Security Management Server (Log Servers)

Otherwise contact TAC

Thanks

Re: Log-server Disconnected

Blason_R — Sat, 04 Sep 2021 04:51:23 GMT

Nah - I resolved on my own. This was an issue with $FWDIR/conf/masters file and I observed that attribute was changed to +i

I changed to -i and rebooted the gws

Re: Log-server Disconnected

the_rock — Sat, 04 Sep 2021 18:46:32 GMT

Would you mind please telling me what exact attribute that is? I have exact same errors in fwd.elg and logging is failing, but cant see any +i option in masters file...thanks in advance.

Re: Log-server Disconnected

Blason_R — Sun, 05 Sep 2021 15:27:18 GMT

May be it could be something else for you. But to check attribute

lsattr $FWDIR/conf/masters

Also if you can check what are the contents of masters file?

Re: Log-server Disconnected

PhoneBoy — Sun, 05 Sep 2021 16:32:27 GMT

That’s the immutable flag, a file attribute at the OS level.
It prevents the file from being overwritten.
Which that file is on policy install: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102712&partition=Advanced&product=Quantum

Re: Log-server Disconnected

the_rock — Sun, 05 Sep 2021 17:34:43 GMT

I think you are probably right...below is what I get

lsattr $FWDIR/conf/masters
---------------- /opt/CPsuite-R81/fw1/conf/masters

Re: Log-server Disconnected

the_rock — Sun, 05 Sep 2021 17:37:07 GMT

Funny thing is, content was default mgmt name and logging was fine for a while, then it stopped with no changes...I ended up changing masters file to mgmt IP address in all fields and then logging started and worked for 2 weeks and then stopped again, so its a bit puzzling as to why this keeps happening.

Re: Log-server Disconnected

the_rock — Tue, 07 Sep 2021 14:08:18 GMT

Funny thing is, never had to do that sk before (at least from what I can remember), but followed it and also changed masters file to reflect mgmt IP and not the name and that worked. Whether that solution will last, remains to be seen : )

Re: Log-server Disconnected

Matlu — Sun, 25 May 2025 00:03:33 GMT

Hello, @Blason_R
One can be able to read binary files oneself?
Or is it necessary to scale these cases to TAC?
I have a “log-server disconnected” problem and I would like to know what is inside the files, without impacting the box services.
Is this possible?

[Expert@FWCP-LV:2]# grep -i "log-server disconnected" $FWDIR/log/fwd.elg*
Binary file /opt/CPsuite-R81.20/fw1/CTX/CTX00002/log/fwd.elg.5 matches
Binary file /opt/CPsuite-R81.20/fw1/CTX/CTX00002/log/fwd.elg.6 matches
Binary file /opt/CPsuite-R81.20/fw1/CTX/CTX00002/log/fwd.elg.7 matches
Binary file /opt/CPsuite-R81.20/fw1/CTX/CTX00002/log/fwd.elg.8 matches
[Expert@FWCP-LV:2]#

Thanks!

Re: Log-server Disconnected

PhoneBoy — Tue, 27 May 2025 16:15:50 GMT

These files can be reviewed without impacting services.
.elg files are not supposed to be "binary" files, though...