topic Re: Error logs in Threat Emulation in General Topics

Error logs in Threat Emulation

Baggy — Mon, 06 Oct 2025 09:03:23 GMT

An event occurred in which an error log in threat emulation was output and files could not be downloaded or uploaded.
Emulation is running on ThreatCloud.

In the log, the reason for the error is explained as follows
Reason：Timeout was exceeded

I think one of the causes is that the emulation connnection handling mode of Threat Emulation is set to Maximum Prevention in the Profile setting of the Threat Prevention Policy.

Do you know the main cause?

Re: Error logs in Threat Emulation

the_rock — Mon, 06 Oct 2025 10:00:57 GMT

Would you mind please send what you have configured under settings in smart console (last tab on the left menu) for that blade? I will send screenshot in a bit.

Andy

Re: Error logs in Threat Emulation

the_rock — Mon, 06 Oct 2025 10:22:57 GMT

This is what I was referring to.

Andy

Re: Error logs in Threat Emulation

Baggy — Tue, 07 Oct 2025 00:17:59 GMT

@the_rock
Thank you for your response.

Here is the Screenshot. It is default.
The fail-mode is set to fail-open.

Re: Error logs in Threat Emulation

the_rock — Tue, 07 Oct 2025 00:21:14 GMT

I selected wrong tab, I meant to choose general...is it set to allow?

Andy

Re: Error logs in Threat Emulation

Baggy — Tue, 07 Oct 2025 00:33:37 GMT

@the_rock
Yes Allow all connections Fail-open

In profile, Maximum Prevention is set and the file cannot be downloaded until the file Emulation is complete.
If this setting is set to Rapid Delivery, it improves, but I would like to know the cause of the error.

Re: Error logs in Threat Emulation

the_rock — Tue, 07 Oct 2025 00:49:36 GMT

See if below sk helps.

https://support.checkpoint.com/results/sk/sk114806

If not, I would try change to background option and install policy. If still no improvement, would certainly open TAC case.

Best,

Andy

Re: Error logs in Threat Emulation

Baggy — Tue, 07 Oct 2025 01:02:48 GMT

@the_rock

I know about this SK.

If i set Rapid Delivery will improve this.
The question is why the Timeout was exceeded error occurs.

Re: Error logs in Threat Emulation

the_rock — Tue, 07 Oct 2025 01:04:06 GMT

I have no clue, sorry. Thats why I sugegsted TAC case.

Andy

Re: Error logs in Threat Emulation

Baggy — Tue, 07 Oct 2025 01:12:38 GMT

I am asking here because the TAC says they don't know.

When I checked the result of tecli show cloud queue at the time of the event, it showed “Cloud Connectivity Problem” and confirmed that there were many files waiting for emulation (inspection) in the queue.

Does this mean that a connection problem with ThreatCloud caused the timeout?
However, some files could be downloaded and uploaded.
Please let me know what you find out.

------------------------
tecli show cloud queue
------------------------

|file's sha1 |file's event_id |file type |insert time |status
|----------------------------------------|----------------------------------------|----------|------------------|----------------------------------------------------------------------
|pdf |203 Minutes |Cloud Connectivity Problem, waiting to resend.
|pdf |197 Minutes |Cloud Connectivity Problem, waiting to resend.
|pdf |96 Minutes |Cloud Connectivity Problem, waiting to resend.
|pdf |94 Minutes |Cloud Connectivity Problem, waiting to resend.
|pdf |88 Minutes |Cloud Connectivity Problem, waiting to resend.
|pdf |85 Minutes |Cloud Connectivity Problem, waiting to resend.
|pdf |82 Minutes |Cloud Connectivity Problem, waiting to resend.
|pdf |81 Minutes |Cloud Connectivity Problem, waiting to resend.
|pdf |77 Minutes |Cloud Connectivity Problem, waiting to resend.
|pdf |75 Minutes |Cloud Connectivity Problem, waiting to resend.
|pdf |16 Minutes |Cloud Connectivity Problem, waiting to resend.
|pdf |7 Minutes |Cloud Connectivity Problem, waiting to resend.
|pdf |205 Minutes |Uploading to Cloud (resend).

Re: Error logs in Threat Emulation

Baggy — Tue, 07 Oct 2025 01:13:10 GMT

I am asking here because the TAC says they don't know.

Re: Error logs in Threat Emulation

the_rock — Tue, 07 Oct 2025 01:16:06 GMT

Hm, thats what it seems like, possibkly connectivity issue to threat cloud...why would that heppen, that Im really not sure. Lets see if someone else may have an idea.

Any other relevant logs that you can send that might be bit more helpful?

Andy

Re: Error logs in Threat Emulation

Baggy — Tue, 07 Oct 2025 01:42:27 GMT

@the_rock

I can't share the details because it is a customer's log, but the Firewall log also recorded an error with File exceeded size limit. However, we verified that if the following settings are set to 15MB and fail-open, files exceeding the size limit can be downloaded.

SmartConsole > Manage & Settings > Blades > Threat Prevention > Advanced Settings >
Threat Emulation > Emulation Limits > Maximum file size for emulation

The maximum processing time in queue is 720 minutes, so I don't think it will be a Fail-open download, but if the error is Timeout was exceeded due to a connection problem with ThreatCloud, why can't the file be downloaded in Fail-open?

Re: Error logs in Threat Emulation

the_rock — Tue, 07 Oct 2025 03:03:23 GMT

Well, here is the way I look at it. If you are saying TAC could not help, the more we get here, better chances we can try solve it. I get you might not be allowed to send certain things, but if you blur out any sensitive data from the log entry, that would help big time.

Best,

Andy

Re: Error logs in Threat Emulation

Baggy — Wed, 15 Oct 2025 01:49:02 GMT

@the_rock

Thank you for your support.
It is possible to blur the log and share it.

Re: Error logs in Threat Emulation

the_rock — Wed, 15 Oct 2025 02:39:57 GMT

Ok, please do share it once ready.

Best,

Andy

Re: Error logs in Threat Emulation

Baggy — Wed, 05 Nov 2025 04:27:06 GMT

@the_rock

I apologize for the delayed response.

After further investigation, I found that at the same time the Firewall log recorded a “Timeout was exceeded” message under Threat Emulation, the tp_failures.elg file also showed evidence of a timeout occurring in the Anti-Virus component, as shown below.

The number of logs, timestamps, source ports, and destination ports all match those of the “Timeout was exceeded” events.

We looked further into the Anti-Virus component, but could not find any information indicating the values for Hold Timeout or Anti-Virus Timeout.

If you have any information regarding this, please let me know.

tp_failures.elg - The failures tp_collector finds (in clear data, you can print this file).
--------------------

Time:6/24 08:47:01; Inst:0; Conn:dir 0, IPP 6; Session:1539566; App:CI_AV; TE Async Response Time:08:37:01; TE Verdict:NONE; RAD Async Response Time:08:37:01; RAD Verdict:ACCEPT; Hold Timeout:08:39:14; AV Record Timeout:08:47:01; Fail-Open:1; Session ended with error:1; av_handler:7fcf5af46208;

Time:6/24 08:48:56; Inst:1; Conn:dir IPP 6; Session:1553737; App:CI_AV; TE Async Response Time:08:38:56; TE Verdict:NONE; Hold Timeout:08:42:43; AV Record Timeout:08:48:56; Fail-Open:1; Session ended with error:1; av_handler:7fcf51ab9c08;

Time:6/24 08:49:21; Inst:0; Conn:dir 0, IPP 6; Session:1540164; App:CI_AV; AV Record Timeout:08:49:21; Fail-Open:1; Session ended with error:1; av_handler:7fcf5af3e608;

Time:6/24 08:51:25; Inst:1; Conn:dir 0, IPP 6; Session:1554664; App:CI_AV; AV Record Timeout:08:51:25; Fail-Open:1; Session ended with error:1; av_handler:7fcf51aba208;

--------------------

Re: Error logs in Threat Emulation

the_rock — Wed, 05 Nov 2025 13:24:29 GMT

Maybe check these things:

Threat Emulation / cloud queues & status
- tecli show cloud queue — shows cloud queue and files stuck in cloud emulation.
- tecli show emulator emulations (or tecli s e e) — status of emulation queue and VM workers.
- tecli show remote queue — if you use an on-prem TE appliance, check the remote queue.
  These were suggested in Check Point docs and community posts for identifying TE backlog/latency.
Check TE/AV statistics and engine health
- tecli show statistics — general TE throughput/latency counters.
- tecli show emulator vm detailed — see VM usage and if VMs are overloaded or unavailable.
- cpview or top — look for high CPU, memory or I/O on the gateway that could delay engine responses. (CPView is in the CLI reference).
Check logs and timestamps correlation
- Inspect tp_failures.elg and the Security logs for the same session IDs/timestamps to correlate TE/AV timeouts with the user traffic.
- If using cloud, check whether tecli show cloud queue shows long upload/processing times (SKs and KBs note cloud latency of minutes in some cases)
Threat Prevention settings to review in SmartConsole
- Manage & Settings → Blades → Threat Prevention → Advanced Settings (Threat Emulation / Anti-Virus). There you can view emulation timeouts, emulation environment (cloud vs on-prem), and rapid-delivery / fail-open behavior. (Docs show where to find these engine settings

Re: Error logs in Threat Emulation

the_rock — Wed, 05 Nov 2025 13:25:39 GMT

Also, under engine settings, I would put it to background instead of hold and install policy, test.

Re: Error logs in Threat Emulation

Baggy — Thu, 06 Nov 2025 09:08:27 GMT

@the_rock

Thank you for your advice.
But I understand the settings you have explained to me.

Based on that, I would like to know under what conditions “Hold Timeout” and “Anti-Virus Timeout” are recorded in tp_failures.elg, and whether there are specific timeout values defined for them.