topic Re: Origin column is empty, R81.20 JHF T84 in General Topics

Origin column is empty, R81.20 JHF T84

saitoh — Mon, 18 May 2026 13:13:38 GMT

Hi experts,

env: CP3600 R81.20 with JHF Take 84, standalone

I cannot conduct research on the issue because the appliance is not within my reach now.

Our customer reported some appliances I configured produced fw.log with Origin column empty.

It causes some trouble for them analyzing access log.

What can be the root cause for this behaviour?

Saitoh

Re: Origin column is empty, R81.20 JHF T84

Chris_Atkinson — Mon, 18 May 2026 13:33:47 GMT

What issue does it cause if it's truly a standalone deployment are logs being sent to a SIEM?

I'm hoping you aren't expecting different origins other than the local machine itself?

Re: Origin column is empty, R81.20 JHF T84

Martijn — Mon, 18 May 2026 13:46:19 GMT

Hi,

With limited information, it is difficult to tell what is going on.

What is the uptime of the appliances?
Did you tried to restart the Check Point services / reboot the appliance?
Did you perform a logswitch?

Take 84 is from september 2024 so I would advice to upgrade to the latest recommended take before investigating this issue.

Regards,
Martijn

Re: Origin column is empty, R81.20 JHF T84

saitoh — Tue, 19 May 2026 00:32:30 GMT

Hi @Chris_Atkinson,

You are right, logs are forwarded for further analysis.

They collect logs from more than 100 sites, and only appliances at different two sites are sending logs with blank origin column.

I will investigate what is going on later, so there is little information gathered so far.

Saitoh

Re: Origin column is empty, R81.20 JHF T84

saitoh — Tue, 19 May 2026 02:00:42 GMT

Hi ,

I am not informed very well, but assume the uptime is over half a year.

Any action which restarts services is not likely to be done.

Saitoh

Re: Origin column is empty, R81.20 JHF T84

Chris_Atkinson — Tue, 19 May 2026 07:44:42 GMT

Origin is present in SmartConsole (Standalone R81.20 JHF T84)... Are you seeing something like sk121553 perhaps, how are you forwarding the logs exactly?