topic Re: Cannot view previous logs after upgrade to R81 in Firewall and Security Management

Cannot view previous logs after upgrade to R81

AndreasD — Thu, 06 May 2021 14:48:17 GMT

Hello,

We have upgraded our Management servers (Management HA) and SmartEvent to R81 from R80.40.

Everything appears to be working as expected except searching the logs. When we try to display traffic from before the upgrade, nothing appears. This happens on the Managements and SmartEvent.

Any ideas or should I address this issue to TAC?

Thank you.

Andreas.

Re: Cannot view previous logs after upgrade to R81

Yifat_Chen — Thu, 06 May 2021 15:21:18 GMT

HI @AndreasD

Known limitation in R81

Re: Cannot view previous logs after upgrade to R81

AndreasD — Thu, 06 May 2021 15:55:20 GMT

Hi @Yifat_Chen,

Thank you for your prompt response.

So in case we would like to utilize some information from the older logs, what could we do? Is there a workaround?

For example, in Logs & Monitor, Options -> File -> Open Log File, would that count as a workaround?

Thanks.

Andreas.

Re: Cannot view previous logs after upgrade to R81

AndreasD — Thu, 06 May 2021 15:58:37 GMT

Hi @Yifat_Chen ,

Apologies for replying without looking at the provided SK. I will have a look at it and if anything remains unclear I will reply again.

Re: Cannot view previous logs after upgrade to R81

the_rock — Thu, 06 May 2021 16:31:49 GMT

That sounds odd...I see the limitation, but I had not seen this issue with any customer who upgraded from R80.xx to R81. I even did it it in my lab and no problems. I really think maybe you should open TAC case to confirm.

Re: Cannot view previous logs after upgrade to R81

AndreasD — Thu, 06 May 2021 17:32:17 GMT

hi@Yifat_Chen @the_rock

I have followed the provided SK and tried to browse to yesterday in order to view logs and it appears to be working. I have set the days to index to 60 so the process will need to run for a while.

If tomorrow for example my bosses ask me to index 90 or 120 days back, would the Management and SmartEvent try to reindex what has already been indexed?

Thank you again.

Re: Cannot view previous logs after upgrade to R81

the_rock — Thu, 06 May 2021 18:36:00 GMT

I am pretty positive answer is yes, it would try to reindex them again, but TAC can confirm for you for sure!

Re: Cannot view previous logs after upgrade to R81

Yaakov_Ohayon — Sun, 09 May 2021 07:17:18 GMT

Hi all,

I'm Kobi Ohayon, from RnD.

The mentioned limitation is indeed true, since in R81 we changed our indexing system (SOLR). So when upgrading to R81, old indexes will not survive and a re-index will be needed.

As a default, we've set the re-index to 1 days back (24 hours), but of course it can be changed to whatever number of days back you like. Please notice the following:

1. If you set the day to index to 60, and then you want to extend it to 90 or 120, already indexed log files will not be re-indexed again. We will skip those files and proceed with the older ones.

2. Offline indexing consumes a lot of CPU time, and might cause log queries to temporarily be unavailable.

3. When you set the re-index for X days back, make sure the maintenance configuration will not delete those indexes right when they created. And also make sure you have enough disk space in /var/log partition.

Thanks.

Re: Cannot view previous logs after upgrade to R81

JozkoMrkvicka — Sun, 09 May 2021 08:02:58 GMT

If you want to see older Firewall logs, then try to view them using old-style SmartView Tracker. As far as .fwlog files are present on the management server, you can open them using SmartView Tracker.

Re: Cannot view previous logs after upgrade to R81

genisis__ — Sun, 09 May 2021 09:19:15 GMT

Agreed - I've found this to be the fast way to view older logs.

Re: Cannot view previous logs after upgrade to R81

AndreasD — Wed, 01 Dec 2021 10:57:33 GMT

Hello Kobi,

Just want to confirm that the above limitation has been resolved.

I am unable to find the wording in R81 known limitations.

Many thanks,

Andreas.

Re: Cannot view previous logs after upgrade to R81

Chris_Atkinson — Wed, 01 Dec 2021 11:38:21 GMT

Installation and Upgrade section of sk166717

Also in case it's relevant to your case see also sk175223.

Re: Cannot view previous logs after upgrade to R81

AndreasD — Fri, 03 Dec 2021 07:30:52 GMT

Thanks mate.

Re: Cannot view previous logs after upgrade to R81

the_rock — Tue, 14 Dec 2021 16:38:34 GMT

I had a case where mgmt was upgraded to R80.10 to R80.40 and then R81 and old logs are gone, but they are still available in old tracker. Whats best way to see them in R81 smart console? I found below sk, but we cant get it working this way.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111766&partition=Advanced&product=SmartLog,

I also followed sk111766, so not sure if it takes 24 hours to see the logs?

Andy