Are Logs Still Visible If Only the index File Remains?

[SubZer0]

On Check Point firewalls, two files are created for each log entry:

• an index file
• a log file

My question is:
If I manually delete the .log file but leave the index file on the firewall —
will the logs still be visible in SmartView Logs / Tracker?

[PhoneBoy · Accepted solution]

The legacy SmartView Tracker only uses the .log file.
If the log file doesn't exist, neither do the log entries.

SOLR only indexes some of the fields in a log entry.
The contents of the "full log card" are in the .log file.
Which suggests you might see log entries in list views still, but "full log card" details won't be possible if you delete the underlying .log file.

Haven't tested this, personally, though.

[the_rock · Accepted solution]

The short answer is no. The logs wont be visible either in old shool SV tracker or logs if only index files remain, you 100% do need .log one as well.

Andy