topic Re: Upgraded to R80.40. Where is the Purge Log function? in Firewall and Security Management

Upgraded to R80.40. Where is the Purge Log function?

Tony_Graham — Thu, 12 Nov 2020 16:22:25 GMT

We recently updated to 80.40 and do not see where the purge logs function has been relocated to in Smart Console.

In the log browser I can see logs going back to 2017 which we do not need and are taking up space.

Thanks.

Re: Upgraded to R80.40. Where is the Purge Log function?

G_W_Albrecht — Thu, 12 Nov 2020 17:53:10 GMT

I found this for R80.40. sk164054: Daily logs retention policy configuration instructions

Re: Upgraded to R80.40. Where is the Purge Log function?

Tony_Graham — Thu, 12 Nov 2020 18:04:37 GMT

Thanks, but it does not seem to purge older log files.

In previous iterations of SmartConsole there was a simple 'Purge log files' menu entry.

Seems to be gone.

Re: Upgraded to R80.40. Where is the Purge Log function?

G_W_Albrecht — Thu, 12 Nov 2020 21:32:04 GMT

I only know the SVTracker Purge active file option - too tedious for your goal. So manual removal is the easiest way.

Re: Upgraded to R80.40. Where is the Purge Log function?

PhoneBoy — Thu, 12 Nov 2020 23:08:07 GMT

The old SmartView Tracker, while deprecated, should still be there: https://community.checkpoint.com/t5/Logging-and-Reporting/Has-SmartView-Tracker-been-eliminated/m-p/2078

Re: Upgraded to R80.40. Where is the Purge Log function?

Tony_Graham — Fri, 13 Nov 2020 16:02:01 GMT

Awesome. Thanks for that Dameon!

Re: Upgraded to R80.40. Where is the Purge Log function?

G_W_Albrecht — Sun, 15 Nov 2020 09:23:24 GMT

SVTracker, you only have the Purge active file option ?

Re: Upgraded to R80.40. Where is the Purge Log function?

Tony_Graham — Mon, 16 Nov 2020 17:30:17 GMT

Unfortunately that is correct. I think a combination of setting the log retention time and purging of the active file is all we can do at the moment.

In SVTracker there is also Tools>Remote File Management. Not sure where it is 'managing' though. I think it only explores the current $FWDIR\log and not all of the legacy folders from previous versions which may also contain older logs.

Re: Upgraded to R80.40. Where is the Purge Log function?

Dror_Aharony — Tue, 17 Nov 2020 07:02:45 GMT

Yes Tony, You're correct.
but as GW_W_Albrecht said, the best & proper method is to use the new daily logs retention in the Mgmt./Log-Server object > Logs > Storage.
"I found this for R80.40. sk164054..."

simply set it as you wish > Install database.
example: 300 days for indexes + 0 extra for log-files==300 days for both log-Indexes & log-files and it'll delete all log & index files that are older than 300 days.

Re: Upgraded to R80.40. Where is the Purge Log function?

G_W_Albrecht — Tue, 17 Nov 2020 07:10:19 GMT

Tools>Remote File Management lists the logs still on a GW and enables you only to fetch them to the SMS/Log server. The old log fles are copied, but originals not deleted issue is history since R80.xx. I would suggest to set the retention and purging, followed by deleting old logs manually once.