topic Re: Patch install investigation in General Topics

Patch install investigation

Agent_Smith — Thu, 13 Jul 2023 13:51:00 GMT

We have one firewall running on r80.40 180 and r80.40 173 is there a way to verify the date when one of the firewalls was patched. We'd like to see if one firewall downgraded or if one never got patched.

Re: Patch install investigation

Chris_Atkinson — Thu, 13 Jul 2023 14:16:55 GMT

Should be some logs here /opt/CPInstLog/

Re: Patch install investigation

Agent_Smith — Thu, 13 Jul 2023 14:49:09 GMT

Thanks I went there in WinSCP is there something specific to look for? There are a lot of folders and files there. I uploaded a screenshot from each of the directories on both firewalls. One that is at 180 an one that is 173.

Re: Patch install investigation

the_rock — Thu, 13 Jul 2023 14:59:41 GMT

You can grep for that take, something like grep -i T180 /opt/CPInstLog/*

Andy

Re: Patch install investigation

Agent_Smith — Thu, 13 Jul 2023 15:07:03 GMT

Thanks what would that accomplish, to see if there are files related to 180?

I tried that and got CLINFR0329 Invalid command:'grep -i T180 /opt/CPInstLog/*'.

Basically we need to see if this rolled back on its own from 180 to 173, if so that's a big problem.

If one was never upgraded. (unlikely but possible)

Re: Patch install investigation

the_rock — Thu, 13 Jul 2023 15:28:48 GMT

To see if there are any lines containing T180...command definitely works, I just did it on my lab

[Expert@CP-FW-1:0]# grep -i T180 /opt/CPInstLog/*

Re: Patch install investigation

Agent_Smith — Thu, 13 Jul 2023 17:05:18 GMT

I got it to work in expert.

Is there something specific I should be looking for, there is a lot of info related to 180 yet the gateway is on 173, quite the mystery.

Re: Patch install investigation

the_rock — Thu, 13 Jul 2023 17:59:13 GMT

Thats a good question. I would try run same command, but something that may give more insightful info needed. So, below is from my lab, not sure if it would help.

Andy

Its R81.20, but version makes no difference, its linux command, so worked the same even in R55 lol

/opt/CPInstLog/install_CPUpdates_BUNDLE_R81_20_JUMBO_HF_MAIN_1.log:[2023-06-03 - 07:42:15][17603 18782]:Testing file: /opt/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#4#BUNDLE_R81_20_JUMBO_HF_MAIN#14/Check_Point_R81_20_JUMBO_HF_MAIN_Bundle_T14_FULL.tgz >>> tar=yes, gzipped=yes
/opt/CPInstLog/install_CPUpdates_BUNDLE_R81_20_JUMBO_HF_MAIN_1.log:[2023-06-03 - 07:42:15][17603 18782]:About to execute command: nice -n 19 gtar --use-compress-program=pigz -xvf /opt/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#4#BUNDLE_R81_20_JUMBO_HF_MAIN#14/Check_Point_R81_20_JUMBO_HF_MAIN_Bundle_T14_FULL.tgz -C /var/log/tmp/bundle_tmpdir_CheckPoint#CPUpdates#All#6.0#5#4#BUNDLE_R81_20_JUMBO_HF_MAIN#14_XAdauc
/opt/CPInstLog/install_CPUpdates_BUNDLE_R81_20_JUMBO_HF_MAIN_1.log:[2023-06-03 - 07:42:33][17603 18782]:Starting install of Check_Point_R81_20_JUMBO_HF_MAIN_Bundle_T14_FULL.tgz
grep: /opt/CPInstLog/progressFiles: Is a directory
grep: /opt/CPInstLog/registry_backup: Is a directory
grep: /opt/CPInstLog/svn: Is a directory

Also, its easy to see from web UI when it was installed, see below.

Re: Patch install investigation

Agent_Smith — Thu, 13 Jul 2023 18:05:22 GMT

The webgui is unavailable atm. I think something unrelated to do with ciphers.

The install date was Feb 4

/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-04 - 09:53:53][5722 14498][HIGH MSG_INSTALL_INITIATING]: Initiating install of fw1_wrapper_HOTFIX_R80_40_JHF_T180_653_MAIN_GA_FULL.tgz
/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-04 - 09:53:54][5722 14498]:isDeplAllowed:: Pre isHFA path: /opt/CPda/repository/CheckPoint#fw1#All#6.0#5#1#HOTFIX_R80_40_JHF_T180_653_MAIN#99400
/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-04 - 09:54:20][5722 14498][HIGH DALOG_NORMAL]: Setting current time as installation time for the package: fw1_wrapper_HOTFIX_R80_40_JHF_T180_653
/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-04 - 09:54:24][5722 14498][HIGH DALOG_NORMAL]: Found recommendation for Check_Point_R80_40_JUMBO_HF_Bundle_T180_sk165456_FULL.tgz.
/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-04 - 09:54:26][5722 14498][HIGH MSG_INSTALL_SUCCEEDED]: Package fw1_wrapper_HOTFIX_R80_40_JHF_T180_653_MAIN_GA_FULL.tgz was installed successful
/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-04 - 09:54:42][5722 14498][HIGH DALOG_NORMAL]: Found recommendation for Check_Point_R80_40_JUMBO_HF_Bundle_T180_sk165456_FULL.tgz.
/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-04 - 09:54:44][5722 14498][HIGH DALOG_NORMAL]: Received request for collecting external tools logs after fw1_wrapper_HOTFIX_R80_40_JHF_T180_653_
/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-04 - 10:01:27][5099 5099][HIGH DALOG_NORMAL]: Found recommendation for Check_Point_R80_40_JUMBO_HF_Bundle_T180_sk165456_FULL.tgz.
/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-04 - 10:01:28][5099 5099][HIGH DALOG_NORMAL]: Package CheckPoint#fw1#All#6.0#5#1#HOTFIX_R80_40_JHF_T180_653_MAIN#994000002 is compatible to inst
/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-04 - 10:01:29][5099 5099][HIGH DALOG_NORMAL]: Found recommendation for Check_Point_R80_40_JUMBO_HF_Bundle_T180_sk165456_FULL.tgz.

Re: Patch install investigation

Agent_Smith — Thu, 13 Jul 2023 18:05:51 GMT

I also found this.

/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-26 - 11:42:43][5099 14487][HIGH DALOG_NORMAL]: Deleting file /opt/CPda/repository/CheckPoint#Major#All#6.0#5#1#BLINK_R80_40_T294_JHF_T180_GW and#All#6.0#5#1#BLINK_R80_40_T294_JHF_T180_GW,/opt/CPda/backup/CheckPoint#Major#All#6.0#5#1#BLINK_R80_40_T294_JHF_T180_GW
/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-26 - 11:42:43][5099 14487][HIGH DALOG_NORMAL]: Failed to remove /opt/CPda/repository/CheckPoint#Major#All#6.0#5#1#BLINK_R80_40_T294_JHF_T180_GW
/opt/CPInstLog/DeploymentAgent.log.1:[2023-02-26 - 11:42:43][5099 14487][HIGH MSG_PKG_REMOVED_FROM_CLOUD]: Package <b>[Latest] R80.40 Security Gateway + JHF T180 for Appliances and Open Servnt cloud. Removing the package from your list.

Re: Patch install investigation

the_rock — Thu, 13 Jul 2023 18:08:47 GMT

Thats promising...appears someone was working on it Feb 4th 2023, or if you look at it from European standards, April 2nd ; )

Re: Patch install investigation

Agent_Smith — Thu, 13 Jul 2023 18:10:29 GMT

But it doesn't explain why its on 173 when it was in theory upgraded to 180 on feb 4.

Re: Patch install investigation

the_rock — Thu, 13 Jul 2023 18:16:10 GMT

Well...not really. There is no concrete proof it was upgraded on Feb 26th, is there? Do we see log stating so? Sorry, I said Feb 4th, I looked at my logs by mistake. Yours show Feb 26th...do this command

[Expert@CP-FW-1:0]# grep -i 2023-02-26 /opt/CPInstLog/* > /var/log/installlog.txt

Dont worry about errors, you will get the file. Go to winscp, get it, open in notepadd++ and check carefully all the logs.

Re: Patch install investigation

Agent_Smith — Thu, 13 Jul 2023 18:18:00 GMT

Ours were supposed to be upgraded on 2/4/2023.

Re: Patch install investigation

the_rock — Thu, 13 Jul 2023 18:21:15 GMT

Then do exact same command I gave, but put 2023-02-04 instead : - )

Re: Patch install investigation

Agent_Smith — Thu, 13 Jul 2023 19:07:50 GMT

This is what was returned. Why would it say r77.30?

grep -i 2023-02-04 /opt/CPInstLog/* > /var/log/installlog.txt
grep: /opt/CPInstLog/AutoUpdateLogs: Is a directory
grep: /opt/CPInstLog/DIlogs: Is a directory
grep: /opt/CPInstLog/collectors: Is a directory
grep: /opt/CPInstLog/install_CPUpdates_BUNDLE_R77_30_JUMBO_HF_3.logDir: Is a directory
grep: /opt/CPInstLog/install_CPUpdates_BUNDLE_R77_30_JUMBO_HF_4.logDir: Is a directory
grep: /opt/CPInstLog/install_CPUpdates_BUNDLE_R77_30_JUMBO_HF_5.logDir: Is a directory
grep: /opt/CPInstLog/install_CPUpdates_BUNDLE_R77_30_JUMBO_HF_6.logDir: Is a directory
grep: /opt/CPInstLog/progressFiles: Is a directory
grep: /opt/CPInstLog/registry_backup: Is a directory
grep: /opt/CPInstLog/svn: Is a directory

on the other cluster member that has the correct r80.40 180 version this is what shows

grep -i 2023-02-04 /opt/CPInstLog/* > /var/log/installlog.txt
grep: /opt/CPInstLog/AutoUpdateLogs: Is a directory
grep: /opt/CPInstLog/DIlogs: Is a directory
grep: /opt/CPInstLog/collectors: Is a directory
grep: /opt/CPInstLog/install_CPUpdates_BUNDLE_R80_40_JUMBO_HF_MAIN_2.logDir: Is a directory
grep: /opt/CPInstLog/install_CPUpdates_BUNDLE_R80_40_JUMBO_HF_MAIN_3.logDir: Is a directory
grep: /opt/CPInstLog/install_CPUpdates_BUNDLE_R80_40_JUMBO_HF_MAIN_4.logDir: Is a directory
grep: /opt/CPInstLog/progressFiles: Is a directory
grep: /opt/CPInstLog/registry_backup: Is a directory
grep: /opt/CPInstLog/svn: Is a directory

Re: Patch install investigation

the_rock — Thu, 13 Jul 2023 19:10:21 GMT

Most likely something left off from old days, but its weird other one does not have it. I would verify for sure with TAC.

Re: Patch install investigation

Agent_Smith — Thu, 10 Aug 2023 15:55:14 GMT

I'd like to say thank you your command and help was superior to all of tac

Re: Patch install investigation

the_rock — Thu, 10 Aug 2023 16:47:49 GMT

Glad we can help. Is issue solved?

Andy