export-management

[Alex-]

SMS, R82 T39, no extra/custom configuration.

We're automating processes at one of our clients and one of these is a weekly export of the SMS for DR/archive purposes.

To remove the drudgery  of managing local scripts, we use REST as much as possible to properly manage execution states and the like from an orchestration platform.

We've tried the export-management API endpoint and ran into the following issues:

• After a while, the API would fail and all management processes would stop, we had to restart the SMS
• It would stay at 98% for hours while a manual migrate_server would take a few minutes. We had to manually stop the task

The export is done in the same version, disk space and so on have been checked (manually, everything works anyway).

api.elg and api.csv and other checks don't show anything special.

So for now, we're back running migrate_server non-interactively and rsync the export via a local job.

I know an answer would be to go through TAC but we don't really have the time and as running the API can have an impact on the production SMS, we'd rather check if this API works in general with the community, in which case we might run in a local specificity.

[HeikoAnkenbrand · Accepted solution]

Hi @Alex-,

I’ve had similar problems before. In my case, the issue was that the API has a timeout of 300 seconds. If a process runs longer — for example, “migrate server export” — the API call is terminated after 300 seconds, and the original process can no longer send any response.

The only solution I found was to increase the timeout value in the Apache configuration.
The problem, however, is that this solution is no longer supported.

Therefore, I would recommend opening a ticket with Check Point regarding this issue.

[the_rock]

Sounds reasonable.

[PhoneBoy]

This API shouldn't time out as it returns a task-id.
@Omer_Kleinstern 

[Daniel_Kuhl1]

Have you considered using the keepalive API call to keep the session alive? Or even better using a while loop to check for the task status every x seconds until the result is not "in progress" anymore or something like this. The export-management API call returns back a task-id you can use with show-task.

[Alex-]

There's still the issue that this API lasts way longer than a manual export, and that sometimes it crashes management services which is the most concerning issue as we can't let it run unsupervised.

I suppose we'll need to go through TAC.