- Products
- Learn
- Local User Groups
- Partners
- More
The Great Exposure Reset
24 February 2026 @ 5pm CET / 11am EST
CheckMates Fest 2026
Watch Now!AI Security Masters
Hacking with AI: The Dark Side of Innovation
CheckMates Go:
CheckMates Fest
I was in the process of writing a script that would grab the "show configuration" from every gateway, but found in the /var/tmp directory on my SMS the exact thing I was looking for. The directory contains a file titled "<IP Address>-configuration.elg" for every gateway that is managed by the SMS, and appears to get updated every day early in the morning. This is great, but now I'm trying to figure out where these files are coming from. There's nothing in the crontab that would account for this. What process, script, whatever is running that creates them? The SMS is R80.10.
Have you setup your gateways to actually run a daily backup and store it on the management server?
I checked on our MDS R80.10 and found 4 files there, but they were dated nov 2017, around the time we installed the boxes, so they are not updated.
I do recall that in the MDS in the first months we had the setting "Sync with usercenter - Sync once a day" turned on

Most probably this setting is on in your management and this will collect the config and upload them to the UC.
That is synchronising only devices names with serial numbers so later on licenses appear in UC with actual devices names and not uploading gateways configs to CP.
I have an MDS environment as well (separate from the SMS environment), and it does NOT have the configuration files that the SMS environment has. I have "Sync with User Center" enabled in both environments. I agree with Martin, the "show configuration" is not a part of this Sync.
Although it is not part of it, it would not hurt to turn it off and see what happens for a couple of days.
I just checked some environments and I also found it and also for SMB appliances (1100/1400).
edit: btw. I have it in my lab environment as well, where I have no backup at all!
So I think that confirms it's some kind of out the box behavior, now just to track down what's doing it...
I tried digging through logs in /var/log, $CPDIR/log and $FWDIR/log on Mgmt and GW by looking at timeframe of backup and didn't found any hint from where it comes....
I have a 1400 and a SMS 80.20 and I have the upload settings disabled and do not see the configuration files on the management server.
Maybe the difference is R80.20. I had the Sync disabled up until last week, but I have files in /var/tmp for some old gateways from last November, when Sync was not turned on.
Sort of curious have you checked cron? Just on there off chance (crontab -l) if you know what I mean
In the opening post he wrote that there's nothing in cron.
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
| User | Count |
|---|---|
| 53 | |
| 41 | |
| 15 | |
| 13 | |
| 12 | |
| 11 | |
| 11 | |
| 10 | |
| 9 | |
| 8 |
Thu 19 Feb 2026 @ 03:00 PM (EST)
Americas Deep Dive: Check Point Management API Best PracticesTue 24 Feb 2026 @ 11:00 AM (EST)
Under The Hood: CloudGuard Network Security for Azure Virtual WANThu 19 Feb 2026 @ 03:00 PM (EST)
Americas Deep Dive: Check Point Management API Best PracticesTue 24 Feb 2026 @ 11:00 AM (EST)
Under The Hood: CloudGuard Network Security for Azure Virtual WANAbout CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY