Upgrading secondary logging server to R82

[cdooer]

Hey everyone. We upgraded our management server from R81.20 to R82 Take 44 several weeks back, and are now planning on doing our secondary logging server. The verify is failing with the attached error message. I'm reading that the primary management server can't have any jumbos installed, but it's got Take 44 which is why it's failing. The upgrade from R81 was done in one fell swoop (R82 with take 44), so how would one uninstall the take in order to get the secondary logging server upgraded?

[the_rock]

Did you make sure based on below screnshow you sent that primary is indeed active and secondary is standby?

 

[cdooer]

It is indeed. This isn't even a secondary management server, it's only purpose is for logging. 

[the_rock]

Fair enough. What do you get with cpstat mg command?

[Expert@CP-MANAGEMENT:0]# cpstat mg

Product Name: Check Point Security Management Server
Major version: 6
Minor version: 0
Build number: 998000009
Is started: 1
Active status: active
ICA status: 0
Status: The Internal Certificate Authority (ICA) certificate is valid until Jan 19 03:14:07 2038 GMT

Connected clients
----------------------------------------------------
|Client type |Administrator|Host |Database lock|
----------------------------------------------------
|SmartConsole|admin |EVE-WIN11|false |
----------------------------------------------------

[Expert@CP-MANAGEMENT:0]#

[the_rock]

This too?

cpprod_util FwIsPrimary

[cdooer]

From the logging server, or the management server?

[cdooer]

Logging
Product Name: Check Point Security Management Server
Major version: 6
Minor version: 0
Build number: 997000016
Is started: 0
Active status: active
ICA status: 0
Status: The Internal Certificate Authority (ICA) certificate is valid until Jan 19 03:14:07 2038 GMT

Connected clients
----------------------------------------------
|Client type|Administrator|Host|Database lock|
----------------------------------------------
----------------------------------------------

Management
Product Name: Check Point Security Management Server
Major version: 6
Minor version: 0
Build number: 998000008
Is started: 1
Active status: active
ICA status: 0
Status: The Internal Certificate Authority (ICA) certificate is valid until Jan 19 03:14:07 2038 GMT

Connected clients
------------------------------------------------------

Logging
cpprod_util FwIsPrimary
0

Management
cpprod_util FwIsPrimary
1

[the_rock · Accepted solution]

Looks right to me. I wonder if its because logging server shows active...

[cdooer · Accepted solution]

You might be onto something. Ran the following command on logging;

cpprod_util FwSetActiveManagement 0

Now shows standby, and the verify shows it's good for clean install or upgrade. I'll proceed with the upgrade and report back. 

[the_rock]

Excellent! Great job! Honestly, I just said that based on pure logic. There are lots smarter people than I on here 🙂

[CheckPointerXL]

this is something that i warned just yesterday https://community.checkpoint.com/t5/Management/Upgrade-Experience-Log-Server-amp-Management-Server-f...

check point needs to update documentation urgently, a lot of admins are failing in this

[the_rock]

I do recall you mentioning it.

[cdooer]

My upgrade completed successfully. I do appreciate the help. 

[the_rock]

Excellent...very happy it worked. We always find a solution on community.