topic Re: Traffic is not visible on management. in General Topics

Traffic is not visible on management.

RemoteUser — Tue, 30 Sep 2025 14:46:53 GMT

Hi Mates.

The customer pointed out something unusual:

We can see traffic on the firewall via tcpdump, but no corresponding logs appear in SmartConsole (management).

Additional, the latest logs available in date back to a week ago, although traffic is clearly flowing through the firewall.

Do you have any ideas on what could be causing this behavior on S1C R82?

Thanks,

Re: Traffic is not visible on management.

the_rock — Tue, 30 Sep 2025 23:39:22 GMT

Hey brother,

Just to confirm, have them verify fw is not logging locally

Have them run this on the gateway from expert -> ls -lh $FWDIR/log/fw.log

If it shows anything other than 8.2 K, it might be logging locally to itself. Or ask them to run watch -d in front that command for 2-3 mins and see if size is growing.

Andy

Re: Traffic is not visible on management.

PhoneBoy — Tue, 30 Sep 2025 15:45:56 GMT

Is it an existing connection (long standing, even) or a new connection?
Because the log entry will show when the connection is initially established and, with appropriate policy/log settings, update every 10 minutes or so with statistics.

Of course, if you're not seeing ANY logs, that's a different issue, and yes, you should check if you're logging locally.
cpstat fw -f log_connection from expert mode is another way to do that.

See also: https://support.checkpoint.com/results/sk/sk170331
Restarting fwd is probably all you need to do here.

Re: Traffic is not visible on management.

emmap — Wed, 01 Oct 2025 03:11:40 GMT

On top of the other suggestions here, make sure the date / time / time zone are correct. The logs come in with a timestamp from the gateway, so if the gateway thinks it's last week then all the logs will be from last week too.

Re: Traffic is not visible on management.

the_rock — Wed, 01 Oct 2025 03:22:10 GMT

Excellent point, Emma.

Andy

Re: Traffic is not visible on management.

RemoteUser — Wed, 01 Oct 2025 06:59:35 GMT

Checked bro seem's fine:
-rw-rw---- 1 admin root 8.2K Oct 1 00:00 /opt/CPsuite-R81.20/fw1/log/fw.log

Re: Traffic is not visible on management.

RemoteUser — Wed, 01 Oct 2025 07:01:44 GMT

It's an existing connection

Re: Traffic is not visible on management.

RemoteUser — Wed, 01 Oct 2025 07:01:57 GMT

yes it's correct

Re: Traffic is not visible on management.

the_rock — Wed, 01 Oct 2025 09:18:28 GMT

Hm...thats odd, makes me wonder if it could be something S1C related. I know one time, while back, I was working with customer and there was some strange issue in the portal, then we tried another browser and was fine.

Can they try that, just to make sure?

Andy

Re: Traffic is not visible on management.

the_rock — Wed, 01 Oct 2025 11:18:15 GMT

Hey brother,

Can you check with the customer please what are the last logs they see in the portal? What exact date?

Andy

Re: Traffic is not visible on management.

Timothy_Hall — Wed, 01 Oct 2025 12:28:47 GMT

A couple of things:

1) Depending on the type of policy layer, if "Connection Logging" is not set for the rule matching the traffic, each individual connection will not get its own log every time. A series of related connections will be "rolled up" into a single log entry by Session Logging, with only a counter being incremented in the existing log for additional related connections. Note that Threat Prevention has its own separate log suppression mechanism. For more information about all this, see here: Max Gander: The Hidden World of Log Generation and Log Suppression at Check Point

2) It is possible that you have an indexer database issue that is keeping you from seeing the proper logs in searches, but they do actually exist in the raw log files on the SMS/Log Server, if you look directly at them without indexing. This problematic behavior became much less likely when the log indexer mechanism was reworked around R81 or so. Try disabling indexing on your SMS/Log Server, but only do this to confirm that an indexer issue is present, as doing this will make log searching very slow.

Alternatively, you can try opening the current fw.log file directly from the Logs & Monitor tab of SmartConsole to verify that the logs are really there. To do this, select the "hamburger" menu on the far right and then select File...Open Log File.

Re: Traffic is not visible on management.

the_rock — Wed, 01 Oct 2025 12:43:16 GMT

All super valid points, Tim.

Re: Traffic is not visible on management.

the_rock — Fri, 03 Oct 2025 00:03:43 GMT

Hey brother, did you end up fixing this?

Best,

Andy

Re: Traffic is not visible on management.

Blason_R — Fri, 03 Oct 2025 03:06:41 GMT

Also did you capture the packets on management server on port 257? That would show if the connection at least established and firewall is sending the logs to management server on port 257

Re: Traffic is not visible on management.

RemoteUser — Fri, 03 Oct 2025 14:18:35 GMT

port 257 it's estabilshed i'm working with tac, it is sip traffic btw

Re: Traffic is not visible on management.

the_rock — Fri, 03 Oct 2025 14:20:04 GMT

Hey bro,

ONLY sip does not get logged, all else does?

Andy

Re: Traffic is not visible on management.

RemoteUser — Fri, 03 Oct 2025 14:20:53 GMT

yes

Re: Traffic is not visible on management.

the_rock — Fri, 03 Oct 2025 14:31:36 GMT

Silly ?, but do they have logging enabled for that rule?

Andy

Re: Traffic is not visible on management.

RemoteUser — Fri, 03 Oct 2025 14:32:36 GMT

yes the rule it's the log per connection

Re: Traffic is not visible on management.

the_rock — Fri, 03 Oct 2025 14:39:07 GMT

Mind sending screenshot? Please blur out any sensitive data.

Andy