topic Re: Are Logs Still Visible If Only the index File Remains? in General Topics

Are Logs Still Visible If Only the index File Remains?

SubZer0 — Fri, 26 Sep 2025 14:02:28 GMT

On Check Point firewalls, two files are created for each log entry:

an index file
a log file

My question is:
If I manually delete the .log file but leave the index file on the firewall —
will the logs still be visible in SmartView Logs / Tracker?

Re: Are Logs Still Visible If Only the index File Remains?

PhoneBoy — Fri, 26 Sep 2025 15:31:34 GMT

The legacy SmartView Tracker only uses the .log file.
If the log file doesn't exist, neither do the log entries.

SOLR only indexes some of the fields in a log entry.
The contents of the "full log card" are in the .log file.
Which suggests you might see log entries in list views still, but "full log card" details won't be possible if you delete the underlying .log file.

Haven't tested this, personally, though.

Re: Are Logs Still Visible If Only the index File Remains?

the_rock — Sat, 27 Sep 2025 00:43:24 GMT

The short answer is no. The logs wont be visible either in old shool SV tracker or logs if only index files remain, you 100% do need .log one as well.

Andy