topic Re: R81 logging issue in Firewall and Security Management

R81 logging issue

D_TK — Sun, 29 Aug 2021 17:24:18 GMT

Hi all -

I have one vm for policy management, and one for smartevent/logging. upgraded both from r80.40 -> r81. Both upgrades were error-free, and both are working fine independently.

The only issue i'm currently having is when I'm connected with dashboard to the policy management vm, i can't view logs from the log server - "smartlog is initializing" changes to "smartlog is not active" after a few minutes. This of course worked fine in 80.40.

Pointing dashboard directly to the log server works fine for viewing logs, but it's nice to highlight a specific rule and see the logs for only that rule.

I've reset SIC, and installed the database on the log server.

Any thoughts would be appreciated.

thanks.

Re: R81 logging issue

Tal_Paz-Fridman — Mon, 30 Aug 2021 10:27:46 GMT

Have you tried simply to stop and start the Security Management Server machine?

There are several SKs for this issue, depending on the root cause:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk129953

HTH

Tal

@Dror_Aharony for additional assistance

Re: R81 logging issue

elisz — Tue, 21 Sep 2021 14:47:08 GMT

Hi @D_TK

Would you be able to share your solution please to this issue?
I just happen to have exactly the same problem and can't seem to find a fix.

Kind Regards,
Eli

Re: R81 logging issue

D_TK — Tue, 21 Sep 2021 13:19:28 GMT

I applied JHA 42 for R81 and it resolved the issue.

Re: R81 logging issue

RS_Daniel — Tue, 21 Sep 2021 16:01:21 GMT

Hello,

It seems to be a bug, i've had the same problem on three differente servers after upgrade to R81. Solution is documented here :

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175223&partition=Advanced&product=SmartReporter

Regards

Re: R81 logging issue

Ido_Shoshana — Sun, 26 Sep 2021 16:44:15 GMT

Hi,

The issue is known and Installing R81 JHF T42 should resolve the issue.

Re: R81 logging issue

Ido_Shoshana — Sun, 26 Sep 2021 16:44:51 GMT

R81 JHF T42 should resolve the issue.

Re: R81 logging issue

Zocki82 — Mon, 27 Sep 2021 15:38:49 GMT

We've had the same issue and opened a SR.
It was fixed by the procedure mentioned in sk175223.

Re: R81 logging issue

Greg_Harbers — Wed, 03 Nov 2021 03:08:22 GMT

FYI,

we have just completed an upgrade of the smartcenter server from R80.40 to R81, Mgmt server has JHF T44, upgrade was an export database, import to new VM, logs servers are still running R80.40 and we had the same issue

following the steps in sk175223 fixed it

Re: R81 logging issue

Ruan_Kotze — Wed, 03 Nov 2021 08:51:47 GMT

Have run into this issue a couple of times - sk175223 is now part of my R81 upgrade process notes.

P.S. Have only seen this when doing in-place upgrade via blink. Migrations have been issue free.

Re: R81 logging issue

Zocki82 — Mon, 15 Nov 2021 08:07:24 GMT

I did a clean R81 installation and imported the old database. The issue occures also in this scenario (did it twice and both times the same issue).