topic Re: Checkpoint Management Log Size Problem in Firewall and Security Management

Checkpoint Management Log Size Problem

slay39 — Mon, 19 Aug 2019 09:07:17 GMT

Hi Checkmates,

When I check the disk situation I saw log directory was full so that I removed old logs from $FWDIR/log/ directory. disk situation is okay now. When I controlled /var/log/opt directory, I saw 854G space allocated. Is that normal? If not, what should I do?

[Expert@hostname:0]# pwd
/var/log/opt
[Expert@hostname:0]# ls
CPSmartLog-R77 CPSmartLog-R80 CPrt-R77 CPrt-R80 CPshrd-R77 CPshrd-R80 CPsuite-R77 CPsuite-R80
[Expert@hostname:0]# du -h --max-depth=1
233M ./CPshrd-R77
173G ./CPsuite-R80
158M ./CPshrd-R80
143G ./CPrt-R77
391G ./CPsuite-R77
60G ./CPrt-R80
88G ./CPSmartLog-R77
200M ./CPSmartLog-R80
854G .
[Expert@hostname:0]#

Re: Checkpoint Management Log Size Problem

G_W_Albrecht — Mon, 19 Aug 2019 09:32:25 GMT

This is a known issue: If the SMS is upgraded In-Place, log files from old $FWDIR/log are copied to the new $FWDIR/log (e.g. /var/opt/CPsuite-R80.30/log). But to have a fallback for times the update fails, old logs are not deleted from e.g. /var/opt/CPsuite-R77.30/log.

You can easily confirm in WinSCP that the old log directories only contain old log files also available in the new log folder and remove these. Also see here how to do that: sk114114: Diskspacemanagement tools do not delete logs from previous Security Management versions

Re: Checkpoint Management Log Size Problem

G_W_Albrecht — Mon, 19 Aug 2019 09:33:48 GMT

Why is this posted in SMB Appliances and SMP ?

Re: Checkpoint Management Log Size Problem

slay39 — Tue, 20 Aug 2019 06:52:35 GMT

I am so sorry for posting this question to wrong category.

I deleted old log files in CPsuite-R77 directory acording to sk114114. There are 88G index files in /var/log/opt/CPSmartLog-R77/data and 143G event files in /var/log/opt/CPrt-R77. Should I do sth for them?

Re: Checkpoint Management Log Size Problem

Dror_Aharony — Tue, 20 Aug 2019 07:11:21 GMT

Yes.

Assuming you're now in R80.x & no longer need the old R77.x SML or SME log/events DBs, then yea.

follow sk157713:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk157713&partition=Advanced&product=SmartLog,

Solution

To resolve the problem, delete the R77.x SmartLog/SmartEvent databases. To do so:

On SmartLog, run:

[Expert@Hostname]# rm -rf /var/log/opt/CPSmartLog-R7*/data/

On SmartEvent, run:

[Expert@Hostname]# rm -rf /var/log/opt/CPrt-R7*/events_db/

for FYI, Also remember your log storage threshold for deletion of current version is probably 5GB or less or whatever you've configured in the Mgmt/LS/SME server's object > Logs Storage > Delete when X...

Re: Checkpoint Management Log Size Problem

CheckPointerXL — Fri, 16 Dec 2022 09:21:07 GMT

Hello Dror,

i'm on R81.10 since 4months.

it is safe to remove this whole folder?

thank you