Database Smartevent Query Failed

[Rafael_Morato]

Hi CheckMates, 

   Sometimes my Smartview or SmartEvent (at smart console) try query for show data in these dashboard and result me Query Failed. I tried procedures in sk114133 but no efects on my Event Server. 

Do you have any Ideia where can I starts debug or find solution for this problem?

Thanks.

[Libin_Thomas]

check cpwd_admin list , may be solr process is terminated you can do debug on solr process or do a evstart

[Rafael_Morato]

So,

That running

cpwd_admin list
APP PID STAT #START START_TIME MON COMMAND
CPVIEWD 20993 E 1 [16:13:37] 1/11/2017 N cpviewd
CPD 21011 E 1 [16:13:38] 1/11/2017 Y cpd
FWD 21089 E 1 [16:13:41] 1/11/2017 N fwd -n
FWM 21092 E 1 [16:13:41] 1/11/2017 N fwm
SOLR 22370 E 3 [18:18:44] 1/11/2017 N java_solr /opt/CPrt-R80/conf/jetty.xml
CPM 21356 E 1 [16:13:42] 1/11/2017 N /opt/CPsuite-R80/fw1/scripts/cpm.sh -s
RFL 7584 E 1 [17:15:06] 1/11/2017 N LogCore
SMARTVIEW 7625 E 1 [17:15:06] 1/11/2017 N SmartView
INDEXER 7679 E 1 [17:15:06] 1/11/2017 N /opt/CPrt-R80/log_indexer/log_indexer
SMARTLOG_SERVER 7723 E 1 [17:15:06] 1/11/2017 N /opt/CPSmartLog-R80/smartlog_server
CPSEMD 7894 E 1 [17:15:07] 1/11/2017 Y cpsemd
CPSEAD 7897 E 1 [17:15:07] 1/11/2017 N cpsead
DASERVICE 21750 E 1 [16:13:46] 1/11/2017 N DAService_script
CPSM 25774 E 1 [16:16:37] 1/11/2017 N cpstat_monitor

[PhoneBoy]

How much RAM is on your SmartEvent server?

[Timothy_Hall]

My thoughts exactly, looks like the SOLR process crashed and got restarted.  There should be a core dump in /var/log/dump/usermode that can help Check Point support figure out what went wrong with the SOLR process.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

[Jason_Dance]

I agree, having enough RAM assigned plays a big part in the stability of SmartEvent.

[Tom_Coussement]

Had the same issue. 

After disabling smart indexing and re-enabling, the issue was solved

[Tiago_de_Souza_]

Hi Tom!

I'm get the same issue, but just for one user... how to disable and re-enable smart indexing?

[Stuart_Green]

So, we've been using some old retired hardware to do security check ups for customers and have had this problem. It seems to be related to the amount of RAM available.  To get around the problem initially, we did the same as Tom by disabling the indexing, pushing policy, re-enabling indexing and pushing policy.  A longer term fix seems to be to add more RAM - problem hasn't come back after that.

[Orel_Vanounou]

These errors can be also seen in R80.10 SmartView widgets (Top Sources, Top Destinations etc.) in a clean DB setup - where performance matters or amount of RAM available were not the triggers.

The cause was an issue with the content of $RTDIR/smartview/db//controls.xml

A Secure Knowledge article will be written soon and will be found by searching for  "Query failed error in R80.10 Smart View widgets"

[Sven_Glock]

Hi Orel,

I did not find the promised SK. Is it already public? 🤗

Btw: I experienced the same issue with R80.20

Cheers

Sven

[Sven_Glock]

In my case restarting log indexing solved the issue...