topic Re: fw.log it's up to 8.2k in General Topics

fw.log it's up to 8.2k

RemoteUser — Wed, 15 Oct 2025 15:39:05 GMT

What's mean?
Why it's not 8.2k?

ls -lh $FWDIR/log/fw.log
-rw-rw---- 1 admin root 1.1G Oct 15 09:40 /opt/CPsuite-R81.20/fw1/log/fw.log

Re: fw.log it's up to 8.2k

the_rock — Wed, 15 Oct 2025 15:45:29 GMT

It means its logging locally, my friend.

Andy

Re: fw.log it's up to 8.2k

RemoteUser — Wed, 15 Oct 2025 15:46:59 GMT

there is a documentation about that? because i don't see anything related

Re: fw.log it's up to 8.2k

Bob_Zimmerman — Wed, 15 Oct 2025 15:47:04 GMT

It means the system is logging locally. This is normal for a log server. If the system is a firewall, it generally means it can't talk to its configured log servers.

Re: fw.log it's up to 8.2k

RemoteUser — Wed, 15 Oct 2025 15:47:57 GMT

this is the output form a one member of ha cluster

Re: fw.log it's up to 8.2k

the_rock — Wed, 15 Oct 2025 15:53:34 GMT

Just do cprestart, easiest way to fix it, since its a cluster.

Re: fw.log it's up to 8.2k

the_rock — Wed, 15 Oct 2025 16:19:22 GMT

Or even better, just restart fwd process, since thats responsible for logging.

Andy

Re: fw.log it's up to 8.2k

RemoteUser — Wed, 15 Oct 2025 16:22:18 GMT

ok brother thanks, but why 8.2k? so if a gateway have 8.2k+ means that doesn't send log to mgmt?

Re: fw.log it's up to 8.2k

the_rock — Wed, 15 Oct 2025 16:24:53 GMT

Thats "magic" number buddy, been like that since R55 or before lol. Point is, it could be 82M, as long as number does NOT go up, thats the key.

It means exactly what you said, not sending to mgmt, its logging locally.

Andy

Re: fw.log it's up to 8.2k

the_rock — Wed, 15 Oct 2025 17:57:09 GMT

Here are the steps:

Log in to Expert mode: Connect to the command line and log in to Expert mode.
Stop the FWD daemon: Run cpwd_admin stop -name FWD.
Start the FWD daemon: Run cpwd_admin start -name FWD to restart i

Andy

Re: fw.log it's up to 8.2k

the_rock — Wed, 15 Oct 2025 18:44:53 GMT

Btw, IF you end up doing cpstop; cpstart, please remember that cpstop always unloads the current policy, just something to keep in mind.

Andy

Re: fw.log it's up to 8.2k

Duane_Toler — Wed, 15 Oct 2025 18:54:31 GMT

On the cluster gateway, you can run this command to see if it's connected to the management server (or log server, whichever is appropriate for you):

cpstat -f log_connection fw

If the log server is not reporting "Connected", then you may need to do some troubleshooting to learn why.

You can see what logging connections are attempted, by running this "netstat" command:

netstat -anp |grep ':257'

This will tell you what remote IP the gateway is attempting to reach. If you see "ESTABLISHED", then the gateway is connected to a log server of some kind. If you see anything else, then you have some kind of network issue.

Look at the "masters" file to see if there is some error or other issue:

ls -l $FWDIR/conf/masters lsattr $FWDIR/conf/masters cat $FWDIR/conf/masters

If you see "----i----------- /etc/fw/conf/masters" in the output of the second command, that means your file is read-only and it cannot be updated each time you do a policy install. You often need this if your management server is hosted behind a NAT gateway, such as a CloudGuard management host.

If the output of the 3rd command looks wrong, then you need to learn why.

Re: fw.log it's up to 8.2k

the_rock — Wed, 15 Oct 2025 18:57:49 GMT

Yes sir! All good points.

I believe below sk is also great reference.

Andy

https://support.checkpoint.com/results/sk/sk40090

Re: fw.log it's up to 8.2k

RemoteUser — Thu, 16 Oct 2025 08:26:51 GMT

thanks all for the tips!!

Re: fw.log it's up to 8.2k

the_rock — Thu, 16 Oct 2025 09:22:07 GMT

Glad we can help bro!