Blink upgrade Smart-1 appliance from R81.20 to R82 fails

[Alex-]

Smart-1 600M appliance running R81.20 T105. CPUSE tools up to date.

R82+T34 Blink Package for SMS was downloaded, verifier returns that upgrade is allowed.

When upgrading, it goes up to 97% then stops and rolls back to R81.20. Tried two times with the same result.

The log doesn't provide clear indication on what's happening. We will open a TAC SR, maybe some Mates can share a similar experience and how they handled this?

[2025-08-07 - 08:27:53][11939 21734]:Its a management machine.
[2025-08-07 - 08:27:53][11939 21734]:Exporting management configuration.
[2025-08-07 - 08:27:53][11939 21734]:------ Exporting Database:  ------
[2025-08-07 - 08:27:53][11939 21734]:Exporting management configuration from source.
[2025-08-07 - 08:27:53][11939 21734]:Testing file: /mnt/fcd//sysimg/CPwrapper/linux/upgrade_tools/linux/ngm_upgrade_wrapper_998001093_1.tgz >>> tar=yes, gzipped=yes
[2025-08-07 - 08:27:53][11939 21734]:About to execute command: nice -n 19 gtar  --use-compress-program=pigz -xvf /mnt/fcd//sysimg/CPwrapper/linux/upgrade_tools/linux/ngm_upgrade_wrapper_998001093_1.tgz -C /mnt/fcd//sysimg/CPwrapper/linux/upgrade_tools/linux/rpm --checkpoint=100
[2025-08-07 - 08:27:53][11939 21734]:-- extraction completed successfully --
[2025-08-07 - 08:27:53][11939 21734]:Installed build=998001165, FCD build=998001093.
[2025-08-07 - 08:27:53][11939 21734]:Installing source upgrade tools on FCD.
[2025-08-07 - 08:27:53][11939 21734]:deploying ngm upgrade tools on partition: /mnt/fcd.
[2025-08-07 - 08:27:53][11939 21734]:Checking ngm upgrade tools package=ngm_upgrade_wrapper_997000853_1.tgz, installed=yes, skipped=no, installed_on='Thu May 22 14:56:53 2025' relevant=no
[2025-08-07 - 08:27:53][11939 21734]:Checking ngm upgrade tools package=ngm_upgrade_wrapper_998001165_1.tgz, installed=yes, skipped=no, installed_on='Wed Jul 23 17:42:17 2025' relevant=yes
[2025-08-07 - 08:27:53][11939 21734]:Installing ngm_upgrade_wrapper_998001165_1.tgz
[2025-08-07 - 08:27:53][11939 21734]:Testing file: /var/log/CPda/repository/CheckPoint#UpgradeTools#All#6.0#5#6#UPG_TOOLS_R82#998001165/ngm_upgrade_wrapper_998001165_1.tgz >>> tar=yes, gzipped=yes
[2025-08-07 - 08:27:53][11939 21734]:About to execute command: nice -n 19 gtar  --use-compress-program=pigz -xvf /var/log/CPda/repository/CheckPoint#UpgradeTools#All#6.0#5#6#UPG_TOOLS_R82#998001165/ngm_upgrade_wrapper_998001165_1.tgz -C /var/log/CPda/repository/CheckPoint#UpgradeTools#All#6.0#5#6#UPG_TOOLS_R82#998001165/rpm --checkpoint=100
[2025-08-07 - 08:27:53][11939 21734]:-- extraction completed successfully --
[2025-08-07 - 08:27:53][11939 21734]:rpm file copied to : /mnt/fcd
[2025-08-07 - 08:27:53][11939 21734]:About to execute command: . /opt/CPshared/5.0/tmp/.CPprofile.sh >/dev/null 2>&1 ;UPGRADE_CONTEXT=cpuse rpm -Uv --force /CPupgrade-tools-R82-00-00.i386.rpm
[2025-08-07 - 08:27:53][11939 21734]:Executing command under chroot: . /opt/CPshared/5.0/tmp/.CPprofile.sh >/dev/null 2>&1 ;UPGRADE_CONTEXT=cpuse rpm -Uv --force /CPupgrade-tools-R82-00-00.i386.rpm
[2025-08-07 - 08:27:53][11939 21734]:. /opt/CPshared/5.0/tmp/.CPprofile.sh >/dev/null 2>&1 ;UPGRADE_CONTEXT=cpuse rpm -Uv --force /CPupgrade-tools-R82-00-00.i386.rpm command summary:
Return code = 0
Output = error: failed to stat /sys/fs/cgroup: No such file or directory
Preparing packages for installation...
CPupgrade-tools-R82-00-00

[2025-08-07 - 08:27:53][11939 21734]:ngm_upgrade_wrapper_998001165_1.tgz was not installed. marked_as_installed=yes, installed_on=Wed Jul 23 17:42:17 2025
[2025-08-07 - 08:27:53][11939 21734]:Deployed 1 ngm upgrade tools packages on partition: /mnt/fcd.
[2025-08-07 - 08:27:54][11939 21734]:Changing permissions (recursively) of /web/htdocs2/html_reports to Bitmask: 755.

[cdav]

not an available command - thankfully 😅

[the_rock]

then its just regular mgmt : - )

Its still odd flag I gave you does not work?

Andy

[cdav]

yes sorry should have stated that. I've never worked on a multi domain/mds environment. 

There aren't any mds prefixed commands available FYI.

[cdav · Accepted solution]

Turns out the issue was that the global domain had both appliances marked as active.

For example:

[Expert@CPMGMT01-A:0]# psql_client cpm postgres -x -c "select objid,name,objclass,domainid,dlesession,deleted from dleobjectderef_data where not deleted and dlesession=0 and objid in (select mds from domainserver_data where domain='1e294ce0-367a-11e3-aa6e-0800200c9a66' and not deleted and dlesession=0);"
-[ RECORD 1 ]------------------------------------------------------------
objid | c7e06651-e93e-41ed-8fcd-e5859e9bf0a9
name |CPMGMT01-A
objclass | com.checkpoint.management.mgmt_blade.objects.CpNetworkObject
domainid | a0eebc99-afed-4ef8-bb6d-fedfedfedfed
dlesession | 0
deleted | f
-[ RECORD 2 ]------------------------------------------------------------
objid | 0cc52cdb-2205-4e41-bd67-f634a335cabd
name |CPMGMT01-B
objclass | com.checkpoint.management.mgmt_blade.objects.CpNetworkObject
domainid | a0eebc99-afed-4ef8-bb6d-fedfedfedfed
dlesession | 0
deleted | f

[Expert@CPMGMT01-A:0]# psql_client cpm postgres -x -c "select * from domainserver_data where domain='1e294ce0-367a-11e3-aa6e-0800200c9a66' and not deleted and dlesession=0;"
-[ RECORD 1 ]---------------+-------------------------------------
objid | 142f23b2-346d-47fb-b800-958e5e85522c
active | t

-[ RECORD 2 ]---------------+-------------------------------------
objid | 60c65504-b312-433d-b42f-0950f4b8f90b
active | t

Once the secondary was set to false database export was successful and subsequently R82 upgrade.

[the_rock]

Good job!

[cdav]

for the record in case anyone ends up searching for things like i did.

Blink images are not supported for secondary management appliances. Must use clean install/upgrade package and apply recommended jumbo in separate stages.

If secondary management hangs on export db and global domains record are as expected on secondary (false and false - for active value) then a reboot of appliance solved the export issue.

My export ran for 2 hrs before failing.

[Vanness_Chen]

Hi experts,

Yesterday, I attempted to upgrade a Smart-1 600-S from R81.10 to R82 using the Blink image, but unfortunately the upgrade was not successful.

Although the system appeared to complete the upgrade process, the FWM process was unable to start. I followed sk178666 to troubleshoot FWM and encountered the following message:

“Found an indication that the current domain was migrated, and the migration had failed. Cannot start after a migration failure.”

Due to limited maintenance time, I had to roll back to R81.10.

I have also come across several similar cases on CheckMates where upgrades using the Blink image did not succeed.
May I kindly ask if there are any recommended best practices, limitations, or specific scenarios where Blink should or should not be used?

Thank you in advance for your guidance.

[emmap]

What is the deployment of the appliance, SMS/Log server/SME?  Does it have internet access to have updated the upgrade files and what not?

[Vanness_Chen]

Hi @emmap 

The SMS does have internet connectivity; however, I usually prefer performing upgrades or Jumbo Hotfix (JHF) installations using an offline method.

Specifically, I download the Blink image from the official website and then upload it locally to the device.

Would this approach be considered not recommended, or are there any best practices or limitations I should be aware of?

[emmap]

No that's a good approach to take, I was more looking to make sure that the DA version and migration scripts would be up to date, which if it has internet access they should be. 

It might be that you can replicate the current server into a VM and try the upgrade again that way, so that if you can replicate the issue, you can troubleshoot without affecting production.