topic Re: show-notifications api spam in General Topics

show-notifications api spam

Henrik_Noerr1 — Fri, 04 Sep 2026 09:31:53 GMT

Hey,

I have had a SR open regarding spam in api.elg (r82 latest jhf)

When an admin is connected to smart console also via web - the client queries the management server api endpoint /show-notifications - this happens every 800ms for each smc session with a policy opened also in read-only sessions

We are a busy shop with some 60 open sessions at a time giving a massive flood in the logs.

This has not always happened, and unsure when it started. However now it is absolutely impossible to tail or track errors in api.elg.

Does anyone know if it is possible to stop this excessive polling? TAC has not been very helpful here, and have gotten a simple /wontfix.

/Henrik

Re: show-notifications api spam

Tal_Paz-Fridman — Fri, 04 Sep 2026 17:16:47 GMT

Hi @Henrik_Noerr1

Where do you see the massive flood in logs? Can you share a screenshot?

Thanks

Re: show-notifications api spam

Henrik_Noerr1 — Mon, 07 Sep 2026 08:00:04 GMT

I see it in api.elg

[Expert@mds-01:0]# tail -f /var/log/opt/CPsuite-R82/fw1/log/api.elg | grep show-notif

2026-09-07 09:51:32,540 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3372074] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,313 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373146] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,314 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3372603] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,324 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373667] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,324 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373666] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,334 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373134] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,335 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3369857] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,345 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3372074] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,346 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373146] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,355 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3372603] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:34,132 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373146] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:34,134 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3372603] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:34,142 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3372098] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:34,145 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373667] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:34,153 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373666] - Executing [show-notifications] of version [2.0.1] (references 1.7)

Re: show-notifications api spam

Shyyyy — Mon, 07 Sep 2026 08:03:09 GMT

Hey,
Check point web smart console is api dependent, which means everything you're doing there is running an api in the background.
Not sure if there's a way to reduce it.
but why would that affect error tracking? you can use grep to track them a lot better.

Re: show-notifications api spam

Henrik_Noerr1 — Mon, 07 Sep 2026 08:50:38 GMT

sure I use grep all the time for this, my grief is the flood which makes proactive error tracking and learning impossible.

Exactly why the api no longer floods the api.elg with the result of a query - it was unnecessary and redundant.

We are peaking at around 614 requests - per second

This translates to around 8500 lines of log per second.

Re: show-notifications api spam

Tal_Paz-Fridman — Mon, 07 Sep 2026 12:04:49 GMT

Hi @Henrik_Noerr1

I have forward your post to the relevant owner in R&D.

Thanks

Tal

Re: show-notifications api spam

Tal_Paz-Fridman — Tue, 08 Sep 2026 06:55:05 GMT

Hi @Henrik_Noerr1

According to R&D we have the I/S to fix the issue and it will be handled in a future release (not sure which)

Thank you for bringing this up!

Tal

Re: show-notifications api spam

Vincent_Bacher — Tue, 08 Sep 2026 07:23:26 GMT

Just searched a bit around and found file $MDS_FWDIR/conf/log4j2.xml (on SMS use $FWDIR instead).
This config seems to be scanned every 5 secs so from my understanding modifications take effect automatically.

In this file I see following settings

<Logger name="com.checkpoint.management.web_api" level="info" additivity="false"> <AppenderRef ref="ApiAppender"/> </Logger> <Logger name="com.checkpoint.management.web_api_is" level="info" additivity="false"> <AppenderRef ref="ApiAppender"/> </Logger>

So I would try and (for sure after creating backup) modify like this to set the log level to warn.

<Logger name="com.checkpoint.management.web_api" level="warn" additivity="false"> <AppenderRef ref="ApiAppender"/> </Logger> <Logger name="com.checkpoint.management.web_api_is" level="warn" additivity="false"> <AppenderRef ref="ApiAppender"/> </Logger>

Fair?

Re: show-notifications api spam

Henrik_Noerr1 — Tue, 08 Sep 2026 08:29:18 GMT

thanks!