topic Missing connection logs after from R81.10 to R81.20 version upgrade in General Topics

Missing connection logs after from R81.10 to R81.20 version upgrade

laszlotakats — Tue, 31 Oct 2023 09:45:49 GMT

Hi all,

I did a version upgrade from R81.10 to R81.20.

After the upgrade, Smartlog works fine from the upgrade date, but cannot show the logs before the upgrade date.

The log files missing (before upgrade date) in the $FWDIR/log directory (<date>.log*), but the audit log (*.adtlog*) are symbolic linked to /var/log/opt/CPsuite-R81.10/fw1/log.

Where are the connection logs? Am I missed something?

Regards,

Re: Missing connection logs after from R81.10 to R81.20 version upgrade

PhoneBoy — Tue, 31 Oct 2023 22:58:00 GMT

Probably best to check with TAC on this: https://help.checkpoint.com

Re: Missing connection logs after from R81.10 to R81.20 version upgrade

the_rock — Tue, 31 Oct 2023 23:26:02 GMT

I was thinking it could be related to below, but if its R81.10 to R81.20, it might not be 100% related...

Andy

https://community.checkpoint.com/t5/Management/SmartLog-only-look-back-14-days-how-to-reindex-90-days-back/td-p/23280

Re: Missing connection logs after from R81.10 to R81.20 version upgrade

laszlotakats — Thu, 02 Nov 2023 09:15:02 GMT

I think I found the source of the problem.

In the "Disk space management setting" field of the management server, in the "Measure free disk space" field, we entered a percentage (see the attached image). Thus, out of 3.2 TB, 2.6 TB was occupied, 20% was free, that is, logs older than 47 days were deleted (these 47 days were calculated from the free disk space). Because of this, the "Daily Log Retention Configuration" also failed to take effect (or delete logs older than 250 days, as you can see the attached image).

Regards,