topic Re: Error in Show logs API in API / CLI Discussion

Error in Show logs API

srinidhi — Mon, 14 Nov 2022 12:36:27 GMT

Hi,

I am trying to get the Checkpoint logs using API from postman and I could see the below error.

I can see all the logs in the smart console. Please let me know if I need to change any settings.

Thanks

Re: Error in Show logs API

the_rock — Mon, 14 Nov 2022 13:02:48 GMT

Not sure if any of below would apply in your case, but maybe worth checking...

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk121379

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk150732

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk121235

Re: Error in Show logs API

srinidhi — Mon, 14 Nov 2022 13:30:36 GMT

Hi Thanks, but I see it works in the smart console, but in the API I get this error. So is there any specific settings to configure management server as log server .

Re: Error in Show logs API

the_rock — Mon, 14 Nov 2022 13:59:00 GMT

Gotcha...just wondering, do you see anything from below command?

https://sc1.checkpoint.com/documents/latest/APIs/?#cli/show-logs~v1.8.1%20

Unless I dont see it, cant really locate section to configure log server, maybe someone else can chime in.

Re: Error in Show logs API

srinidhi — Mon, 14 Nov 2022 14:07:06 GMT

I see server_error with the command

Re: Error in Show logs API

the_rock — Mon, 14 Nov 2022 14:17:20 GMT

Can you try api restart?

Re: Error in Show logs API

PhoneBoy — Mon, 14 Nov 2022 14:18:08 GMT

What is your precise API call?
Also, version/JHF level?

Re: Error in Show logs API

srinidhi — Mon, 14 Nov 2022 14:39:15 GMT

yes, but still the same error

Re: Error in Show logs API

srinidhi — Mon, 14 Nov 2022 14:41:37 GMT

Please find my API call:

and the version is R81 take 392

Re: Error in Show logs API

PhoneBoy — Mon, 14 Nov 2022 15:40:32 GMT

What are the hardware specs on your management/log server?
Specify RAM, CPUs, and disk allocated.

Re: Error in Show logs API

the_rock — Mon, 14 Nov 2022 15:55:54 GMT

Not that good with API, but wanted to try this in the lab, except cant open https://mgmtIP:port/web-api link. Let me see whats missing.

Re: Error in Show logs API

srinidhi — Mon, 14 Nov 2022 17:36:04 GMT

Please let me know if this works for you

curl --insecure -XPOST "https://mgmtIP:port/web-api /login" --data-binary "{\"user\": \"xxx\", \"password\": \”xxxx\"}" -H "Content-Type: application/json"

Re: Error in Show logs API

the_rock — Mon, 14 Nov 2022 17:47:35 GMT

I replaced the values but says curl command not found.

Re: Error in Show logs API

Duane_Toler — Mon, 14 Nov 2022 17:53:06 GMT

You need "new-query.time-frame" as well.

Re: Error in Show logs API

srinidhi — Mon, 14 Nov 2022 18:02:18 GMT

I get the same error as in the post, when I tried with new-query.time-frame

I assume that I need to configure management server as log server, but I am confused that I can see logs in the Smart Console, not sure if I am right, Please let me know what are the steps to check and change log server configuration.

Re: Error in Show logs API

PhoneBoy — Mon, 14 Nov 2022 18:09:55 GMT

The management server is the log server unless you've configured an external log and/or SmartEvent server.
What are the hardware specs on your management/log server?
Specify the amount of RAM, CPUs, and disk allocated.

Re: Error in Show logs API

srinidhi — Tue, 15 Nov 2022 05:53:16 GMT

Please find the configuration

RAM - 11GB

CPU- 2 cores

Storage- 200GB

Re: Error in Show logs API

Duane_Toler — Tue, 15 Nov 2022 14:44:28 GMT

As @PhoneBoy said, your management should be your log server. What do you get with the API call "show-checkpoint-host name <server name> details-level full"? You should see:

"management-blades" : { ... "logging-and-status" : true, ... } ... "logs-settings" : { "enable-log-indexing" : true, ... }

If not, then you need to enable the Logging blade on your management object as well as log indexing. The show-logs API requires the indexer to be running. Use SmartConsole to enable both options:

* Edit your management object, select the the "Logging and Status" checkbox in the Products list

* On the left tree, select Logs, and enable Log Indexing

* Click OK, publish changes

You'll have to wait for the indexer to load the logs into the database which can take time, depending on your log size and any historical logs. If you need to load historical logs, then you'll need to use sk111766.

Re: Error in Show logs API

Amir_Senn — Tue, 15 Nov 2022 15:35:26 GMT

It only shows log server working in index mode. IDK if relevant in your case but if the server is not indexing the logs it might explain the error for no log servers available.

Re: Error in Show logs API

srinidhi — Wed, 16 Nov 2022 04:36:06 GMT

Thanks, after enabling the log indexing, it is working