topic Re: Debug & restart logs in quantum spark 1800 in Spark Firewall (SMB)

Debug & restart logs in quantum spark 1800

asdfn — Sun, 12 Jan 2025 08:11:29 GMT

Hello All,

Our environment uses a Quantum Spark 1800 as a security gateway that recently restarted unexpectedly during office hours. Though the downtime lasted only 3 minutes, we need to understand the cause to prevent future occurrences. Are debug or error logs available? Since we use SmartConsole to collect firewall logs, it would be helpful if there were a feature to send crash and reboot event logs to SmartConsole for monitoring and investigation.

Additionally, while reviewing logs and online resources, we discovered that the "OS112" best practice in the compliance blade enables administrators to record memory issues from Gaia when processes terminate abnormally. Could this help investigate the sudden restart issue? If so, where can we enable and review this best practice?

Many Thanks

Re: Debug & restart logs in quantum spark 1800

Chris_Atkinson — Sun, 12 Jan 2025 09:20:15 GMT

If you're already running R81.10.15 please collect a Dr. Spark report and submit to TAC for further analysis.

Along with a CPinfo per: sk138892

Re: Debug & restart logs in quantum spark 1800

asdfn — Mon, 13 Jan 2025 01:41:41 GMT

Thank you for your information. Since we purchased the product via a vendor, i might need to further request with them about opening a TAC. I will try to use Dr.Spark later.

Besides, are there any debug or error logs we can send from the appliance to SmartConsole? Also, we are curious about whether the BP OS112 in the compliance blade would be helpful in this scenario.

Re: Debug & restart logs in quantum spark 1800

Chris_Atkinson — Mon, 13 Jan 2025 05:48:18 GMT

CPinfo & Dr. Spark should have the needed information then once the issue/symptom is understood better TAC will advise if a specific debug plan is required.

Beyond this you can investigate sending logs to a syslog server where needed but this typically isn't the SMS itself.

Re: Debug & restart logs in quantum spark 1800

G_W_Albrecht — Mon, 13 Jan 2025 08:32:16 GMT

You have bought Support & Services with the box - if this is Direct Support, you could use the MAC of the SMB to get help using CP Chat in UC. With Collaborative Support, your vendor would have to contact your CCSP for your issue and hanlde the SR with CP TAC.

You can send System and Security Logs to your SMS: https://sc1.checkpoint.com/documents/SMB_R81.10.X/Help/Locally_Managed/EN/Content/Topics/Configuring-External-Log-Servers.htm?cshid=help_Logs_MonitoringLogServers

As this is locally managed, you could also use Infinity Portal Spark Management (license is included!) to see the logs, events and much more: