topic Re: How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ? in General Topics

How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ?

S_E_ — Mon, 15 Jun 2026 08:53:09 GMT

hi,

trying to uninstall JHF 113 prompts me to uninstall HOTFIX_LOGEXPORTER_AUTOUPDATE

Never saw this. I'm pretty sure that there was no manual installation of this logexport HF.

How is it possible to uninstall the log export and JHF113 ?

Any ideas?

Thanks

MGMT> show installer packages
** ************************************************************************* **
** Connection error. Packages list might be incomplete **
** ************************************************************************* **
** ************************************************************************* **
** Hotfixes **
** ************************************************************************* **
Display name Status
R81.20 Jumbo Hotfix Accumulator Recommended Jumbo Take 113 Installed
R81.20 Jumbo Hotfix Accumulator Recommended Jumbo Take 120 Imported
** ************************************************************************* **
** Majors **
** ************************************************************************* **
Display name Status
Check_Point_R81.20_T631_Fresh_Install_and_Upgrade.tgz Downloaded
Check_Point_R81.20_T634_Fresh_Install_and_Upgrade.tgz Installed

MGMT> installer uninstall Check_Point_R81_20_jumbo_hf_main_Bundle_T113_FULL.tgz
The machine will automatically reboot after uninstall of Check_Point_R81_20_jumbo_hf_main_Bundle_T113_FULL.tgz.
Do you want to continue? ([y]es / [n]o / [s]uppress reboot) y

Info: Initiating uninstall of Check_Point_R81_20_jumbo_hf_main_Bundle_T113_FULL.tgz...
Interactive mode is enabled. Press CTRL + C to exit (this will not stop the operation)
Result: Uninstall_Last_Take Failed. There are hotfixes installed on top of R81.20 Jumbo Hotfix Accumulator Recommended Jumbo Take 113.
Uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE and try again.

Re: How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ?

Duane_Toler — Mon, 15 Jun 2026 14:30:22 GMT

If you want to update to a newer Jumbo HFA, you don't need to uninstall the current one. Download the latest one (JHF 146 as of this morning) and run the verifier on it. Jumbo HFAs since 113 have several updates for the LogExporter package via AutoUpdater.

If you REALLY want to remove it, then you need to do it with autoupdatercli:

Show current package:

[Expert@cpmgmt01:0]# autoupdatercli show logExporter product-name: logExporter component-name: logExporter component-branch: logExporter_AutoUpdate GA-Version: 0 download-scheduler-active: true install-scheduler-active: true download-action: idle install-revert-action: idle installation-date: 2026-06-10_11:54:23 package-branch-name: logExporter_AutoUpdate package-version: 53 package-name: Check_Point_LOGEXPORTER_AUTOUPDATE_Bundle_linux50_T53_FULL.tgz package-installed: true ##<<< HERE package-installable: true package-previously-installed: false

Remove a component:

autoupdatercli revert-completely logExporter Revert request handled. To see installation status, see logs: /opt/CPInstLog/AutoUpdater.log and /opt/CPInstLog/AutoUpdateLogs/logExporter

Check it again:

[Expert@cpmgmt01:0]# autoupdatercli show logExporter product-name: logExporter component-name: logExporter component-branch: logExporter_AutoUpdate GA-Version: 0 download-scheduler-active: true install-scheduler-active: true download-action: idle install-revert-action: idle installation-date: 2026-06-10_11:54:23 package-branch-name: logExporter_AutoUpdate package-version: 53 package-name: Check_Point_LOGEXPORTER_AUTOUPDATE_Bundle_linux50_T53_FULL.tgz package-installed: false ##<<< HERE package-installable: false package-previously-installed: false

Re: How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ?

the_rock — Mon, 15 Jun 2026 14:33:52 GMT

That sounds right.

Re: How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ?

S_E_ — Mon, 15 Jun 2026 15:30:03 GMT

Hi,

thanks for the tip.

Logexporter HF was successfully removed.

However, even after a reboot, the uninstalltion of the HJF113 came with the same error message.

Regards

MGMT# autoupdatercli show logExporter

product-name: logExporter

component-name: logExporter
component-branch: logExporter_AutoUpdate
GA-Version: 0
download-scheduler-active: true
install-scheduler-active: true
download-action: idle
install-revert-action: idle

installation-date: not available
package-branch-name: logExporter_AutoUpdate
package-version: 44
package-name: Check_Point_LOGEXPORTER_AUTOUPDATE_Bundle_T44_FULL.tgz
package-installed: false
package-installable: true
package-previously-installed: false

installation-date: 2026-02-15_12:52:16
package-branch-name: logExporter_AutoUpdate
package-version: 53
package-name: Check_Point_LOGEXPORTER_AUTOUPDATE_Bundle_linux50_T53_FULL.tgz
package-installed: false
package-installable: true
package-previously-installed: true

installation-date: 2026-06-07_06:03:40
package-branch-name: logExporter_AutoUpdate
package-version: 65
package-name: Check_Point_LOGEXPORTER_AUTOUPDATE_Bundle_linux50_T65_FULL.tgz
package-installed: true
package-installable: true
package-previously-installed: false


[MGMT# autoupdatercli revert-completely logExporter

Revert request handled. To see installation status, see logs: /opt/CPInstLog/AutoUpdater.log and /opt/CPInstLog/AutoUpdateLogs/logExporter

[MGMT# autoupdatercli show logExporter

product-name: logExporter

component-name: logExporter
component-branch: logExporter_AutoUpdate
GA-Version: 0
download-scheduler-active: true
install-scheduler-active: true
download-action: idle
install-revert-action: idle

installation-date: 2026-06-07_06:03:40
package-branch-name: logExporter_AutoUpdate
package-version: 65
package-name: Check_Point_LOGEXPORTER_AUTOUPDATE_Bundle_linux50_T65_FULL.tgz
package-installed: false
package-installable: false
package-previously-installed: false


####MANUAL REBOOT


MGMT> installer uninstall
** ************************************************************************* **
** Connection error. Packages list might be incomplete **
** ************************************************************************* **
** ************************************************************************* **
** Hotfixes **
** ************************************************************************* **

Num Display name Type
1 R81.20 Jumbo Hotfix Accumulator Recommended Jumbo Take 113 Hotfix
MGMT> installer uninstall 1
The machine will automatically reboot after uninstall of Check_Point_R81_20_jumbo_hf_main_Bundle_T113_FULL.tgz.
Do you want to continue? ([y]es / [n]o / [s]uppress reboot) y

Info: Initiating uninstall of Check_Point_R81_20_jumbo_hf_main_Bundle_T113_FULL.tgz...
Interactive mode is enabled. Press CTRL + C to exit (this will not stop the operation)
Result: Uninstall_Last_Take Failed. There are hotfixes installed on top of R81.20 Jumbo Hotfix Accumulator Recommended Jumbo Take 113. Uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE and try again.

Re: How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ?

Duane_Toler — Mon, 15 Jun 2026 15:29:33 GMT

Interesting.. do you really need to remove JHF 113 tho? That's not required if you just want to install JHF 146 for the CVE hotfix.

Re: How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ?

S_E_ — Mon, 15 Jun 2026 15:32:48 GMT

Hi,

yes, I need to go back to HF 65

Has nothing to do with he latest CVE.

Worst case would be to revert snaphot with initial R81.20

Regards

Re: How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ?

Duane_Toler — Mon, 15 Jun 2026 15:41:16 GMT

Ok, got it.

Run this command in expert mode and look for the hotfix package name here, too:

da_cli packages_info |jq -r '.packages[].filename'

It might not appear, if so, then you should be able to remove it manually:

da_cli uninstall package=(whatever the filename was) reboot_delay=10

I added a 10-second reboot delay to give you time to logout of the shell without your connection being cut (if this is a firewall, too).

You can monitor the status of the process if you want:

watch da_cli get_status_of_action actionID=(the Action ID number from the previous command)

No guarantees on that method, tho.

You can also try to uninstall the JHF 113 package this way, and use the "completely" method:

da_cli uninstall package= Check_Point_R81_20_jumbo_hf_main_Bundle_T113_FULL.tgz method=completely reboot_delay=10

Then monitor it the same way as the above action status command.

Re: How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ?

S_E_ — Mon, 15 Jun 2026 18:55:19 GMT

Hi,

Thanks a lot for input.

Tried now 4 different uninstall commands. All without sucess.

Regards


da_cli packages_info |jq -r '.packages[].filename'
Check_Point_R81.20_T631_Fresh_Install_and_Upgrade.tgz
Check_Point_R81.20_T634_Fresh_Install_and_Upgrade.tgz
Check_Point_R81_20_jumbo_hf_main_Bundle_T113_FULL.tgz




da_cli uninstall package=Check_Point_LOGEXPORTER_AUTOUPDATE_Bundle_linux50_T65_FULL.tgz reboot_delay=10
da_cli uninstall package=Check_Point_LOGEXPORTER_AUTOUPDATE_Bundle_linux50_T53_FULL.tgz reboot_delay=10
da_cli uninstall package=Check_Point_LOGEXPORTER_AUTOUPDATE_Bundle_T44_FULL.tgz reboot_delay=10

-> all 3 commands same result
"Message" : "This package is not installed",
"Progress" : "100",
"Status" : "success"




###JHF

da_cli uninstall package=Check_Point_R81_20_jumbo_hf_main_Bundle_T113_FULL.tgz method=completely reboot_delay=10

da_cli get_status_of_action actionID=105
{
"Action ID" : "105",
"Action Type" : "Uninstall_Completely",
"DAService State" : "ready",
"ExtendedMessage" : "N/A",
"Message" : "HOTFIX_R81_20_JUMBO_HF_MAIN",
"Package" : "Check_Point_R81_20_jumbo_hf_main_Bundle_T113_FULL.tgz",
"Progress" : "0",
"Status" : "failure"

Re: How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ?

the_rock — Mon, 15 Jun 2026 19:00:24 GMT

what about autoupdatercli?

Re: How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ?

Duane_Toler — Mon, 15 Jun 2026 20:18:49 GMT

Dang... it still refuses. Not sure if you'll be able to remove that package, then. You can look at the full autoupdatercli output and see if that package is indeed still installed. Just run "autoupdatercli show" without any other parameters. It'll be a very long output list so you'll have to scan through it to see if that specific package is listed.

Re: How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ?

S_E_ — Tue, 16 Jun 2026 06:01:35 GMT

Hi,

hm, still the same:

[MGMT]# autoupdatercli show
grep -B1 'package-installed: true' listauto.txt

package-name: Check_Point_Deployment_Installer_Bundle_T31_FULL.tgz
package-installed: true
--
package-name: Check_Point_Self_Update_Bundle_linux50_T90_FULL.tgz
package-installed: true
--
package-name: Check_Point_INFRA_CONFIG_AUTOUPDATE_Bundle_T21_FULL.tgz
package-installed: true
--
package-name: Check_Point_CloudGuard_Controller_R81_20_AutoUpdate_T37_FULL.tgz
package-installed: true
--
package-name: Check_Point_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE_Bundle_T21_FULL.tgz
package-installed: true
--
package-name: Check_Point_ESOD_CSHELL_AUTOUPDATE_Bundle_T20_FULL.tgz
package-installed: true
--
package-name: Check_Point_dc_content_Bundle_T20_FULL.tgz
package-installed: true
--
package-name: Check_Point_dc_infra_Bundle_T30_FULL.tgz
package-installed: true
--
package-name: Check_Point_GOT_MGMT_AUTOUPDATE_Bundle_T139_FULL.tgz
package-installed: true
--
package-name: Check_Point_GOT_TPCONF_MGMT_AUTOUPDATE_Bundle_T41_FULL.tgz
package-installed: true
--
package-name: Check_Point_WEBCONSOLE_AUTOUPDATE_Bundle_T173_FULL.tgz
package-installed: true
--
package-name: Check_Point_NGM_DOCTOR_AUTOUPDATE_Bundle_T28_FULL.tgz
package-installed: true
--
package-name: Check_Point_VCE_R81_20_AUTOUPDATE_Bundle_T47_FULL.tgz
package-installed: true
--
package-name: Check_Point_CPOtlpAgent_AutoUpdate_Bundle_T141_FULL.tgz
package-installed: true
--
package-name: Check_Point_CPotelcol_AutoUpdate_Bundle_T223_FULL.tgz
package-installed: true
--
package-name: Check_Point_CPquid_AutoUpdate_Bundle_T57_FULL.tgz
package-installed: true
--
package-name: Check_Point_CPviewExporter_AutoUpdate_Bundle_T88_FULL.tgz
package-installed: true
--
package-name: Check_Point_CFU_AutoUpdate_Bundle_T23_FULL.tgz
package-installed: true
--
package-name: Check_Point_HCP_AUTOUPDATE_Bundle_T93_FULL.tgz
package-installed: true
--
package-name: Check_Point_CPSDC_AUTOUPDATE_Bundle_T43_FULL.tgz
package-installed: true
--
package-name: Check_Point_Shared_Object_Bundle_T231_FULL.tgz
package-installed: true
--
package-name: Check_Point_TUNNEL_AUTOUPDATE_Bundle_T138_FULL.tgz
package-installed: true
--
package-name: Check_Point_Gateways_Onboarding_Bundle_T59_FULL.tgz
package-installed: true
--
package-name: Check_Point_Change_Report_Client_Bundle_T28_FULL.tgz
package-installed: true
--
package-name: Check_Point_Change_Report_Bundle_T53_FULL.tgz
package-installed: true
--
package-name: Check_Point_ENDER_V17_AUTOUPDATE_Bundle_T26_FULL.tgz
package-installed: true
--
package-name: Check_Point_GAIA_API_AUTOUPDATE_Bundle_T11_FULL.tgz
package-installed: true
--
package-name: Check_Point_INEXT_NANO_EGG_AUTOUPDATE_Bundle_linux50_T41_FULL.tgz
package-installed: true
--
package-name: Check_Point_Autonomous_Firewall_Bundle_linux50_T94_FULL.tgz
package-installed: true


da_cli uninstall package=Check_Point_CPviewExporter_AutoUpdate_Bundle_T88_FULL.tgz reboot_delay=10
{
"Action ID" : "107",
"Delay" : "10",
"Message" : "uninstall command delivered to service.",
"Package" : "Check_Point_CPviewExporter_AutoUpdate_Bundle_T88_FULL.tgz"
}

[MGMT]# da_cli get_status_of_action actionID=107
{
"Action ID" : "107",
"Action Type" : "Uninstall",
"DAService State" : "ready",
"ExtendedMessage" : "N/A",
"Message" : "This package is not installed",
"Package" : "Check_Point_CPviewExporter_AutoUpdate_Bundle_T88_FULL.tgz",
"Progress" : "100",
"Status" : "success"

....
There are hotfixes installed on top of R81.20 Jumbo Hotfix Accumulator Recommended Jumbo Take 113. 
Uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE and try again.

Re: How to uninstall the hotfix(es) HOTFIX_LOGEXPORTER_AUTOUPDATE' ?

emmap — Tue, 16 Jun 2026 07:30:06 GMT

Autoupdater patches shouldn't interfere with JHF installs / uninstalls. This probably needs to be investigated via TAC so it can be escalated to RnD teams.