Error in Show logs API

[srinidhi]

Hi,

I am trying to get the Checkpoint logs using API from postman and I could see the below error.

I can see all the logs in the smart console. Please let me know if I need to change any settings.

Thanks

[the_rock]

Not sure if any of below would apply in your case, but maybe worth checking...

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[srinidhi]

Hi Thanks, but I see it works in the smart console, but in the API I get this error. So is there any specific settings to configure management server as log server .

[the_rock]

Gotcha...just wondering, do you see anything from below command?

https://sc1.checkpoint.com/documents/latest/APIs/?#cli/show-logs~v1.8.1%20

Unless I dont see it, cant really locate section to configure log server, maybe someone else can chime in.

[srinidhi]

I see server_error with the command

[the_rock]

Can you try api restart?

[srinidhi]

yes, but still the same error

[Duane_Toler]

You need "new-query.time-frame" as well.

[srinidhi]

I get the same error as in the post, when I tried with new-query.time-frame

I assume that I need to configure management server as log server, but I am confused that I can see logs in the Smart Console,  not sure if I am right, Please let me know what are the steps to check and change log server configuration.

[PhoneBoy]

The management server is the log server unless you've configured an external log and/or SmartEvent server.
What are the hardware specs on your management/log server?
Specify the amount of RAM, CPUs, and disk allocated.

[srinidhi]

Please find the configuration

RAM - 11GB

CPU- 2 cores

Storage- 200GB

[Duane_Toler · Accepted solution]

As @PhoneBoy said, your management should be your log server.  What do you get with the API call "show-checkpoint-host name <server name> details-level full"?  You should see:

  "management-blades" : {
...
   "logging-and-status" : true,
...
 }
...
  "logs-settings" : {
    "enable-log-indexing" : true,
...
  }

If not, then you need to enable the Logging blade on your management object as well as log indexing.  The show-logs API requires the indexer to be running.  Use SmartConsole to enable both options:

* Edit your management object, select the the "Logging and Status" checkbox in the Products list

* On the left tree, select Logs, and enable Log Indexing

* Click OK, publish changes

You'll have to wait for the indexer to load the logs into the database which can take time, depending on your log size and any historical logs.  If you need to load historical logs, then you'll need to use sk111766.

[srinidhi]

Thanks, after enabling the log indexing, it is working

[PhoneBoy]

What is your precise API call?
Also, version/JHF level?

[srinidhi]

Please find my API call:

and the version is R81 take 392

[PhoneBoy]

What are the hardware specs on your management/log server?
Specify RAM, CPUs, and disk allocated.

[the_rock]

Not that good with API, but wanted to try this in the lab, except cant open https://mgmtIP:port/web-api link. Let me see whats missing.

[srinidhi]

Please let me know if this works for you

curl --insecure -XPOST "https://mgmtIP:port/web-api /login" --data-binary "{\"user\": \"xxx\", \"password\": \”xxxx\"}" -H "Content-Type: application/json"

[the_rock]

I replaced the values but says curl command not found.

[Amir_Senn · Accepted solution]

It only shows log server working in index mode. IDK if relevant in your case but if the server is not indexing the logs it might explain the error for no log servers available.