topic Re: Reappearing log indexing message in Firewall and Security Management

Reappearing log indexing message

HristoGrigorov — Wed, 21 Nov 2018 10:17:19 GMT

Hi,

I am getting this message every time I switch back and forth log tabs and it does not want to go away no matter how many times I restart SmartConsole. Logging otherwise seems to work fine. Advise me what to do please?

Latest R80.20 MNGT server and SmartConsole.

Re: Reappearing log indexing message

Gaurav_Pandya — Wed, 21 Nov 2018 13:23:49 GMT

Yeah. Recently we have upgraded server from R77.30 to R80.20 and I am also getting same error.

In our case, Logs are also not coming properly. I have checked all configuration in Log setting. It is properly configured. Do we need any additional setting in R80.20?

Re: Reappearing log indexing message

PhoneBoy — Thu, 22 Nov 2018 06:04:45 GMT

Sounds like both of you should open TAC cases on this.

Re: Reappearing log indexing message

David_Brodin — Wed, 30 Jan 2019 17:30:52 GMT

Did you ever resolve this issue? We are experiencing the same warning on a newly upgraded r80.20 (jumbo take 17) with dedicated logserver. Although everything seems normal when searching.

I did find this kb, that shed some light on why r80.20 seems so much faster in searching

We'll need to think about the above kb, on what we want/need.

Re: Reappearing log indexing message

HristoGrigorov — Thu, 31 Jan 2019 04:08:03 GMT

Hello David,

Message still appears, but it does not bother me too much because otherwise everything else works fine. I may try applying this KB as well, thanx for the info.

Re: Reappearing log indexing message

David_Brodin — Thu, 31 Jan 2019 08:02:26 GMT

Sorry if I was unclear, I'm pretty sure that kb doesn't help the warning.

Else, glad I could help

Re: Reappearing log indexing message

Dmitry_Krupnik — Fri, 01 Feb 2019 09:26:31 GMT

Hi Hristo,

We would like to investigate this issue. Could you open a ticket in the TAC and send me its number by email (should be available in the my profile)?

Re: Reappearing log indexing message

HristoGrigorov — Fri, 01 Feb 2019 09:56:59 GMT

Hello Dima,

SR created and mail sent to you.

Thanx for your support.

Re: Reappearing log indexing message

Philip_Huss — Mon, 11 Feb 2019 08:49:27 GMT

Hello all,

Anyone got any solution for this issue?

Re: Reappearing log indexing message

Dmitry_Krupnik — Mon, 11 Feb 2019 10:17:00 GMT

Hello Philip,

Thanks to Hristo, currently the issue under investigation. I will keep you updated.

Regards,

Dmitry.

Re: Reappearing log indexing message

David_Brodin — Wed, 13 Feb 2019 21:05:12 GMT

We got our message fixed.

We have a dedicated log server, but mgmt logs its own logs to itself and the logserver. The mgmt log was not configured to index, but logserver was. After enabling indexing on mgmt, message disappeared.

Re: Reappearing log indexing message

HristoGrigorov — Fri, 15 Feb 2019 06:29:59 GMT

Any of you guys experiencing this issue to have two NICs configured on their SMS ?

Re: Reappearing log indexing message

David_Brodin — Fri, 15 Feb 2019 07:26:10 GMT

I’ve got two NICs on my mgmt, but not experiencing the issue anymore since my “fix”.

Re: Reappearing log indexing message

HristoGrigorov — Fri, 15 Feb 2019 09:15:33 GMT

I am almost sure problem happens on dual NIC systems. Good that it now works for you. We are still investigating it with RnD.

Re: Reappearing log indexing message

Philip_Huss — Fri, 08 Mar 2019 11:48:51 GMT

Hello again,

Any status?

Thanks in advance.

Re: Reappearing log indexing message

HristoGrigorov — Fri, 08 Mar 2019 13:41:47 GMT

Today's reply from TAC:

An update concerning our joint effort with R&D:
"Due to customer logs, we could find the wrong behavior.
We already have a possible idea for solving it but it will take some time to investigate if it will work.
We will update again once we have progressed on this task."

Seems like we need a bit more time to compile a solution for this issue.
I will update you again once we have another progress report.

Re: Reappearing log indexing message

eth4_ — Fri, 24 May 2019 17:36:08 GMT

I had this issue after upgrading management from 80.10 to 80.20. I discovered I had both SmartConsoles installed. After uninstalling the 80.10 console, the warning looks to be gone for good.

ymmv