Log view problem after upgrade to R81.20

[starmen2000]

Hi Mates,

We upgraded the Management Server from R81.10 to R81.20. However, post-upgrade, we observed an issue related to Log view. In order to view logs from before the upgrade, we have to open a specific log file. Consequently, we are unable to see the previous logs without opening a specific log file.

Is this behavior normal, or do we need to take any additional steps to view previous logs without opening a log file?

Thanks

[emmap]

If you follow the 'To change log indexing settings' steps from here it should reindex the older log files back as far as you specify,

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_LoggingAndMonitoring_AdminGu...

[starmen2000]

Unfortunately it did not help. I think  To change log indexing settings affect the system after upgrade, as I see from this sk. https://support.checkpoint.com/results/sk/sk111766  it is also similar issue.

[Amir_Senn]

Hi,

No need to change index settings, R81.10 and R81.20 run on same SOLR version so no need to re-index.

Though if you can open log files but see nothing without it, it's 99% indexer issue.

1. If you did an upgrade and your log server is not your MGMT server, please make sure to perform "Install database" operation.

2. You can stop and restart indexer to see if it solves the issue. "stopIndexer ; startIndexer ;"

3. If 1 and 2 doesn't solve the issue, look for errors in $INDEXERDIR/log/log_indexer.elg.

[cem82]

Don't know if it would still apply for R81.20 but have had similar behavior in R81.10 (not after an upgrade) and needed to rebuild the index.  It can take a while to rebuild the index though so might pay to test out on a specific log file first https://support.checkpoint.com/results/sk/sk164553

Or what we had to do for all log files

evstop
rm -r $RTDIR/log_indexes/other*
rm -r $RTDIR/log_indexes/audit*
rm -r $RTDIR/log_indexes/firewallandvpn*
rm -r $RTDIR/log_indexes/smartevent*
rm $INDEXERDIR/data/FetchedFiles
evstart

May also check out https://support.checkpoint.com/results/sk/sk167895

[the_rock]

I believe it would be the same, correct.

Andy

[Amir_Senn]

I wouldn't recommend this unless you're completely certain. This will delete all your indexes which will cause your logs to be unavailable for searching and depending on amount of logs will require resources to re-index them.

[the_rock]

What if someone back them up and then copy them over after upgrade? That should work, right?

Andy

[Amir_Senn]

IDK, I think it will cause issues. FetchedFiles is what keeps check on what was indexes, if you overwrite it or leave it as it is now, it will create a mismatch. Not sure what will happen.

[the_rock]

Ah, gotcha, that makes sense.

Best,

Andy