topic Re: log_indexer unable to index all the files in Firewall and Security Management

log_indexer unable to index all the files

Blason_R — Wed, 27 May 2020 08:11:03 GMT

Hi Team,

we are on R80.20 Smart 1 appliance and previously due to the memory crunch Smart log wasn't activated. However recently we upgraded to 16GB of RAM and enable the log_indexing; installed the database. The process has successfully started and able to start indexing however we could see it was able to index only last 2 days of files in 14 hrs.

I checked the logs and this is currently indexing existing files/logs however it not picking up the earlier logs. The process is alive and the same can be spotted from cpwd_admin list.

Any hint would be appreciated.

Re: log_indexer unable to index all the files

Wolfgang — Wed, 27 May 2020 08:50:46 GMT

@Blason_R

see R80.x SmartLog/SmartEvent server doesn't index/show logs older than 1-14 days back

to enable the indexer to process your older logs.

Wolfgang

Re: log_indexer unable to index all the files

Blason_R — Wed, 27 May 2020 09:54:53 GMT

yes - was aware of that let me try that option.

Thanks for pointing it out.

Re: log_indexer unable to index all the files

Blason_R — Wed, 27 May 2020 11:18:00 GMT

By the way according to the sk I need to run log_indexer command, but unsure the exact flags needs to run.

has anyone have any experience with the flag or if someone can confirm below command is correct?

./log_indexer -days_to_index <NUM_OF_DAYS_TO_INDEX>

i.e.

./log_indexer -days_to_index 30

Re: log_indexer unable to index all the files

JakubSykora — Tue, 19 Dec 2023 17:44:37 GMT

Hi, yes command is correct. See Support, Support Requests, Training, Documentation, and Knowledge base for Check Point products and services