topic Re: Database Smartevent Query Failed in Firewall and Security Management

Database Smartevent Query Failed

Rafael_Morato — Wed, 01 Nov 2017 20:32:13 GMT

Hi CheckMates,

Sometimes my Smartview or SmartEvent (at smart console) try query for show data in these dashboard and result me Query Failed. I tried procedures in sk114133 but no efects on my Event Server.

Do you have any Ideia where can I starts debug or find solution for this problem?

Thanks.

Re: Database Smartevent Query Failed

Libin_Thomas — Wed, 01 Nov 2017 20:48:59 GMT

check cpwd_admin list , may be solr process is terminated you can do debug on solr process or do a evstart

Re: Database Smartevent Query Failed

Rafael_Morato — Wed, 01 Nov 2017 20:51:49 GMT

So,

That running

cpwd_admin list
APP PID STAT #START START_TIME MON COMMAND
CPVIEWD 20993 E 1 [16:13:37] 1/11/2017 N cpviewd
CPD 21011 E 1 [16:13:38] 1/11/2017 Y cpd
FWD 21089 E 1 [16:13:41] 1/11/2017 N fwd -n
FWM 21092 E 1 [16:13:41] 1/11/2017 N fwm
SOLR 22370 E 3 [18:18:44] 1/11/2017 N java_solr /opt/CPrt-R80/conf/jetty.xml
CPM 21356 E 1 [16:13:42] 1/11/2017 N /opt/CPsuite-R80/fw1/scripts/cpm.sh -s
RFL 7584 E 1 [17:15:06] 1/11/2017 N LogCore
SMARTVIEW 7625 E 1 [17:15:06] 1/11/2017 N SmartView
INDEXER 7679 E 1 [17:15:06] 1/11/2017 N /opt/CPrt-R80/log_indexer/log_indexer
SMARTLOG_SERVER 7723 E 1 [17:15:06] 1/11/2017 N /opt/CPSmartLog-R80/smartlog_server
CPSEMD 7894 E 1 [17:15:07] 1/11/2017 Y cpsemd
CPSEAD 7897 E 1 [17:15:07] 1/11/2017 N cpsead
DASERVICE 21750 E 1 [16:13:46] 1/11/2017 N DAService_script
CPSM 25774 E 1 [16:16:37] 1/11/2017 N cpstat_monitor

Re: Database Smartevent Query Failed

PhoneBoy — Thu, 02 Nov 2017 06:21:16 GMT

How much RAM is on your SmartEvent server?

Re: Database Smartevent Query Failed

Timothy_Hall — Thu, 02 Nov 2017 12:05:56 GMT

My thoughts exactly, looks like the SOLR process crashed and got restarted. There should be a core dump in /var/log/dump/usermode that can help Check Point support figure out what went wrong with the SOLR process.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

Re: Database Smartevent Query Failed

Jason_Dance — Thu, 02 Nov 2017 14:17:28 GMT

I agree, having enough RAM assigned plays a big part in the stability of SmartEvent.

Re: Database Smartevent Query Failed

Tom_Coussement — Mon, 06 Nov 2017 10:33:40 GMT

Had the same issue.

After disabling smart indexing and re-enabling, the issue was solved

Re: Database Smartevent Query Failed

Stuart_Green — Fri, 02 Feb 2018 14:59:37 GMT

So, we've been using some old retired hardware to do security check ups for customers and have had this problem. It seems to be related to the amount of RAM available. To get around the problem initially, we did the same as Tom by disabling the indexing, pushing policy, re-enabling indexing and pushing policy. A longer term fix seems to be to add more RAM - problem hasn't come back after that.

Re: Database Smartevent Query Failed

Orel_Vanounou — Sat, 27 Oct 2018 12:25:10 GMT

These errors can be also seen in R80.10 SmartView widgets (Top Sources, Top Destinations etc.) in a clean DB setup - where performance matters or amount of RAM available were not the triggers.

The cause was an issue with the content of $RTDIR/smartview/db//controls.xml

A Secure Knowledge article will be written soon and will be found by searching for "Query failed error in R80.10 Smart View widgets"

Re: Database Smartevent Query Failed

Tiago_de_Souza_ — Mon, 17 Dec 2018 16:57:19 GMT

Hi Tom!

I'm get the same issue, but just for one user... how to disable and re-enable smart indexing?

Re: Database Smartevent Query Failed

Sven_Glock — Mon, 02 Sep 2019 12:26:31 GMT

Hi Orel,

I did not find the promised SK. Is it already public? 🤗

Btw: I experienced the same issue with R80.20

Cheers

Sven

Re: Database Smartevent Query Failed

Sven_Glock — Mon, 02 Sep 2019 14:21:48 GMT

In my case restarting log indexing solved the issue...