topic Re: Sanity Check - Maestro connected appliances only update one /var/log in Hyperscale Firewall (Maestro)

Sanity Check - Maestro connected appliances only update one /var/log

George_Ellis — Wed, 29 Jan 2025 15:16:15 GMT

Good day,

I searched and either it is not covered or my search sucked. I assume this is an "everybody knows that", but it is new to me.

I was chasing an issue with a potential false positive SNMP report to our collector. What is not important. I inspected /var/log/messages in Appliance 1 (from Orchestator "m 1 1"). When I went to appliance 2 and 3 ("m 1 2" and "m 1 3"), none of the files in /var/log were recent (2+ years old). Made me go "Huh?" It made some sense if you wanted to have 1 point to investigate. But considering dmesg also was ancient history, I started wondering.

Are the logs really consolidated on appliance 1, or they are somewhere else and I am missing it?

Re: Sanity Check - Maestro connected appliances only update one /var/log

Dario_Perez — Wed, 29 Jan 2025 16:48:42 GMT

there are some possibilities.

Appliance came with maestro version and only were added to SG without change the clock.
NTP was unreachable and set to SGM to old date and recovery at some point.

keep in mind that could be cosmetic

Re: Sanity Check - Maestro connected appliances only update one /var/log

George_Ellis — Wed, 29 Jan 2025 18:30:58 GMT

Sorry, that is not the issue. That would have been easy. Time Date are correct, and there are some other files that are current like smart.log.dbg for example.

Re: Sanity Check - Maestro connected appliances only update one /var/log

Lloyd_Braun — Wed, 29 Jan 2025 19:37:30 GMT

The logs are not consolidated on 1 device. You can use "asg log" command to query some logs across all cluster members. Viewing a Log File (asg log) You will probably see more current logs in your $FWDIR/log/* directories. My /var/log has some that haven't updated since last reboot, some since before that. There are a few with current timestamps in there though.