Querying from a restored logs

[flachance]

I have been asked to query for some access information on a specific date. For that date in SmartConsole Logs there is nothing. The logs from that date have been deleted due to disk space constraints. I succesfully restored the logs for that date in $FWDIR\log but still nothing shows if a try to query in SmartConsole Logs & Monitor. Do I have to do an additional step to see these again?

Thanks

Francis

[the_rock]

Hey Francis,

I assume you are referring to below search in smart console?

Andy

 

[flachance]

Sorry I should have joined a screenshot but yes that's what I'm referring to.

Thanks

[the_rock]

No problem, all good : - )

K, so just to make sure 100%, when you are in $FWDIR/log dir on your mgmt server, you do see the right log file there?

Andy

Below is from my R81.20 lab

[Expert@QUANTUM-MANAGEMENT:0]# pwd
/opt/CPsuite-R81.20/fw1/log
[Expert@QUANTUM-MANAGEMENT:0]# ls -lh *.log
-rw-rw-r-- 1 admin config 1.3M Nov 27 2022 2022-11-27_000000.log
-rw-rw-r-- 1 admin config 2.1M Nov 28 00:00 2022-11-28_000000.log
-rw-rw---- 1 admin root 2.3M Nov 29 00:00 2022-11-29_000000.log
-rw-rw---- 1 admin root 2.2M Nov 30 00:00 2022-11-30_000000.log
-rw-rw---- 1 admin root 2.3M Dec 1 00:00 2022-12-01_000000.log
-rw-rw---- 1 admin root 2.7M Dec 2 00:00 2022-12-02_000000.log
-rw-rw---- 1 admin root 2.7M Dec 3 00:00 2022-12-03_000000.log
-rw-rw---- 1 admin root 2.5M Dec 4 00:00 2022-12-04_000000.log
-rw-rw---- 1 admin root 2.6M Dec 5 00:00 2022-12-05_000000.log
-rw-rw---- 1 admin root 2.6M Dec 6 00:00 2022-12-06_000000.log
-rw-rw---- 1 admin root 2.8M Dec 7 00:00 2022-12-07_000000.log
-rw-rw---- 1 admin root 2.7M Dec 8 00:00 2022-12-08_000000.log
-rw-rw---- 1 admin root 3.0M Dec 9 00:00 2022-12-09_000000.log
-rw-rw---- 1 admin root 4.1M Dec 10 00:00 2022-12-10_000000.log
-rw-rw---- 1 admin root 3.7M Dec 11 00:00 2022-12-11_000000.log
-rw-rw---- 1 admin root 3.7M Dec 12 00:00 2022-12-12_000000.log
-rw-rw---- 1 admin root 3.7M Dec 13 00:00 2022-12-13_000000.log
-rw-rw---- 1 admin root 3.6M Dec 14 00:00 2022-12-14_000000.log
-rw-rw---- 1 admin root 3.9M Dec 15 00:00 2022-12-15_000000.log
-rw-rw---- 1 admin root 4.7M Dec 16 00:00 2022-12-16_000000.log
-rw-rw---- 1 admin root 4.6M Dec 17 00:00 2022-12-17_000000.log
-rw-rw---- 1 admin root 4.6M Dec 18 00:00 2022-12-18_000000.log
-rw-rw---- 1 admin root 4.6M Dec 19 00:00 2022-12-19_000000.log
-rw-rw---- 1 admin root 4.1M Dec 20 00:00 2022-12-20_000000.log
-rw-rw---- 1 admin root 7.0M Dec 21 00:00 2022-12-21_000000.log
-rw-rw---- 1 admin root 8.1M Dec 22 00:00 2022-12-22_000000.log
-rw-rw---- 1 admin root 8.5M Dec 23 00:00 2022-12-23_000000.log
-rw-rw---- 1 admin root 7.6M Dec 24 00:00 2022-12-24_000000.log
-rw-rw---- 1 admin root 5.9M Dec 25 00:00 2022-12-25_000000.log
-rw-rw---- 1 admin root 4.9M Dec 26 00:00 2022-12-26_000000.log
-rw-rw---- 1 admin root 5.9M Dec 27 00:00 2022-12-27_000000.log
-rw-rw---- 1 admin root 6.0M Dec 28 00:00 2022-12-28_000000.log
-rw-rw---- 1 admin root 8.1M Dec 29 00:00 2022-12-29_000000.log
-rw-rw---- 1 admin root 5.6M Dec 30 00:00 2022-12-30_000000.log
-rw-rw---- 1 admin root 4.0M Dec 31 00:00 2022-12-31_000000.log
-rw-rw---- 1 admin root 4.1M Jan 1 00:00 2023-01-01_000000.log
-rw-rw---- 1 admin root 4.1M Jan 2 00:00 2023-01-02_000000.log
-rw-rw---- 1 admin root 4.6M Jan 3 00:00 2023-01-03_000000.log
-rw-rw---- 1 admin root 9.2M Jan 4 00:00 2023-01-04_000000.log
-rw-rw---- 1 admin root 13M Jan 5 00:00 2023-01-05_000000.log
-rw-rw---- 1 admin root 9.9M Jan 6 00:00 2023-01-06_000000.log
-rw-rw---- 1 admin root 5.8M Jan 7 00:00 2023-01-07_000000.log
-rw-rw---- 1 admin root 4.6M Jan 8 00:00 2023-01-08_000000.log
-rw-rw---- 1 admin root 3.3M Jan 8 17:27 2023-01-08_172706.log
-rw-rw---- 1 admin root 1.3M Jan 9 00:00 2023-01-09_000000.log
-rw-rw---- 1 admin root 5.3M Jan 10 00:00 2023-01-10_000000.log
-rw-rw---- 1 admin root 6.4M Jan 11 00:00 2023-01-11_000000.log
-rw-rw---- 1 admin root 6.3M Jan 12 00:00 2023-01-12_000000.log
-rw-rw---- 1 admin root 7.6M Jan 13 00:00 2023-01-13_000000.log
-rw-rw---- 1 admin root 6.8M Jan 14 00:00 2023-01-14_000000.log
-rw-rw---- 1 admin root 4.9M Jan 15 00:00 2023-01-15_000000.log
-rw-rw---- 1 admin root 5.0M Jan 16 00:00 2023-01-16_000000.log
-rw-rw---- 1 admin root 6.1M Jan 17 00:00 2023-01-17_000000.log
-rw-rw---- 1 admin root 5.0M Jan 18 00:00 2023-01-18_000000.log
-rw-rw---- 1 admin root 7.1M Jan 19 00:00 2023-01-19_000000.log
-rw-rw---- 1 admin root 6.2M Jan 20 00:00 2023-01-20_000000.log
-rw-rw---- 1 admin root 6.2M Jan 21 00:00 2023-01-21_000000.log
-rw-rw---- 1 admin root 4.8M Jan 22 00:00 2023-01-22_000000.log
-rw-rw---- 1 admin root 4.7M Jan 23 00:00 2023-01-23_000000.log
-rw-rw---- 1 admin root 6.0M Jan 24 00:00 2023-01-24_000000.log
-rw-rw---- 1 admin root 5.3M Jan 25 00:00 2023-01-25_000000.log
-rw-rw---- 1 admin root 5.9M Jan 26 00:00 2023-01-26_000000.log
-rw-rw---- 1 admin root 5.8M Jan 27 00:00 2023-01-27_000000.log
-rw-rw---- 1 admin root 5.0M Jan 28 00:00 2023-01-28_000000.log
-rw-rw---- 1 admin root 4.8M Jan 29 00:00 2023-01-29_000000.log
-rw-rw---- 1 admin root 4.8M Jan 30 00:00 2023-01-30_000000.log
-rw-rw---- 1 admin root 5.4M Jan 31 00:00 2023-01-31_000000.log
-rw-rw---- 1 admin root 5.6M Feb 1 00:00 2023-02-01_000000.log
-rw-rw---- 1 admin root 5.7M Feb 2 00:00 2023-02-02_000000.log
-rw-rw---- 1 admin root 7.7M Feb 3 00:00 2023-02-03_000000.log
-rw-rw---- 1 admin root 5.5M Feb 4 00:00 2023-02-04_000000.log
-rw-rw---- 1 admin root 5.2M Feb 5 00:00 2023-02-05_000000.log
-rw-rw---- 1 admin root 5.3M Feb 6 00:00 2023-02-06_000000.log
-rw-rw---- 1 admin root 6.1M Feb 7 00:00 2023-02-07_000000.log
-rw-rw---- 1 admin root 6.1M Feb 8 00:00 2023-02-08_000000.log
-rw-rw---- 1 admin root 6.9M Feb 9 00:00 2023-02-09_000000.log
-rw-rw---- 1 admin root 6.3M Feb 10 00:00 2023-02-10_000000.log
-rw-rw---- 1 admin root 6.2M Feb 11 00:00 2023-02-11_000000.log
-rw-rw---- 1 admin root 5.1M Feb 12 00:00 2023-02-12_000000.log
-rw-rw---- 1 admin root 5.1M Feb 13 00:00 2023-02-13_000000.log
-rw-rw---- 1 admin root 5.9M Feb 14 00:00 2023-02-14_000000.log
-rw-rw---- 1 admin root 8.4M Feb 15 00:00 2023-02-15_000000.log
-rw-rw---- 1 admin root 6.0M Feb 16 00:00 2023-02-16_000000.log
-rw-rw---- 1 admin root 5.8M Feb 17 00:00 2023-02-17_000000.log
-rw-rw---- 1 admin root 5.7M Feb 18 00:00 2023-02-18_000000.log
-rw-rw---- 1 admin root 5.2M Feb 19 00:00 2023-02-19_000000.log
-rw-rw---- 1 admin root 5.2M Feb 20 00:00 2023-02-20_000000.log
-rw-rw---- 1 admin root 5.1M Feb 21 00:00 2023-02-21_000000.log
-rw-rw---- 1 admin root 5.8M Feb 22 00:00 2023-02-22_000000.log
-rw-rw---- 1 admin root 5.2M Feb 23 00:00 2023-02-23_000000.log
-rw-rw---- 1 admin root 6.4M Feb 24 00:00 2023-02-24_000000.log
-rw-rw---- 1 admin root 5.8M Feb 25 00:00 2023-02-25_000000.log
-rw-rw---- 1 admin root 5.3M Feb 26 00:00 2023-02-26_000000.log
-rw-rw---- 1 admin root 5.3M Feb 27 00:00 2023-02-27_000000.log
-rw-rw---- 1 admin root 6.0M Feb 28 00:00 2023-02-28_000000.log
-rw-rw---- 1 admin root 6.3M Mar 1 00:00 2023-03-01_000000.log
-rw-rw---- 1 admin root 7.5M Mar 2 00:00 2023-03-02_000000.log
-rw-rw---- 1 admin root 7.1M Mar 3 00:00 2023-03-03_000000.log
-rw-rw---- 1 admin root 7.0M Mar 4 00:00 2023-03-04_000000.log
-rw-rw---- 1 admin root 6.5M Mar 5 00:00 2023-03-05_000000.log
-rw-rw---- 1 admin root 6.5M Mar 6 00:00 2023-03-06_000000.log
-rw-rw---- 1 admin root 7.2M Mar 7 00:00 2023-03-07_000000.log
-rw-rw---- 1 admin root 6.8M Mar 8 00:00 2023-03-08_000000.log
-rw-rw---- 1 admin root 5.3M Mar 9 00:00 2023-03-09_000000.log
-rw-rw---- 1 admin root 5.8M Mar 10 00:00 2023-03-10_000000.log
-rw-rw---- 1 admin root 5.7M Mar 11 00:00 2023-03-11_000000.log
-rw-rw---- 1 admin root 5.4M Mar 12 00:00 2023-03-12_000000.log
-rw-rw---- 1 admin root 4.8M Mar 13 00:00 2023-03-13_000000.log
-rw-rw---- 1 admin root 5.0M Mar 14 00:00 2023-03-14_000000.log
-rw-rw---- 1 admin root 13M Mar 15 00:00 2023-03-15_000000.log
-rw-rw---- 1 admin root 39M Mar 16 00:00 2023-03-16_000000.log
-rw-rw---- 1 admin root 36M Mar 17 00:00 2023-03-17_000000.log
-rw-rw---- 1 admin root 35M Mar 18 00:00 2023-03-18_000000.log
-rw-rw---- 1 admin root 34M Mar 19 00:00 2023-03-19_000000.log
-rw-rw---- 1 admin root 35M Mar 20 00:00 2023-03-20_000000.log
-rw-rw---- 1 admin root 35M Mar 21 00:00 2023-03-21_000000.log
-rw-rw---- 1 admin root 20M Mar 22 00:00 2023-03-22_000000.log
-rw-rw---- 1 admin root 7.3M Mar 23 00:00 2023-03-23_000000.log
-rw-rw---- 1 admin root 6.3M Mar 24 00:00 2023-03-24_000000.log
-rw-rw---- 1 admin root 6.0M Mar 25 00:00 2023-03-25_000000.log
-rw-rw---- 1 admin root 6.5M Mar 26 00:00 2023-03-26_000000.log
-rw-rw---- 1 admin root 5.6M Mar 27 00:00 2023-03-27_000000.log
-rw-rw---- 1 admin root 5.8M Mar 28 00:00 2023-03-28_000000.log
-rw-rw---- 1 admin root 5.0M Mar 29 00:00 2023-03-29_000000.log
-rw-rw---- 1 admin root 4.9M Mar 30 00:00 2023-03-30_000000.log
-rw-rw---- 1 admin root 5.5M Mar 31 00:00 2023-03-31_000000.log
-rw-rw---- 1 admin root 5.1M Apr 1 00:00 2023-04-01_000000.log
-rw-rw---- 1 admin root 5.2M Apr 2 00:00 2023-04-02_000000.log
-rw-rw---- 1 admin root 4.8M Apr 3 00:00 2023-04-03_000000.log
-rw-rw---- 1 admin root 4.3M Apr 4 00:00 2023-04-04_000000.log
-rw-rw---- 1 admin root 4.5M Apr 5 00:00 2023-04-05_000000.log
-rw-rw---- 1 admin root 3.9M Apr 6 00:00 2023-04-06_000000.log
-rw-rw---- 1 admin root 3.8M Apr 7 00:00 2023-04-07_000000.log
-rw-rw---- 1 admin root 4.3M Apr 8 00:00 2023-04-08_000000.log
-rw-rw---- 1 admin root 3.7M Apr 9 00:00 2023-04-09_000000.log
-rw-rw---- 1 admin root 3.9M Apr 10 00:00 2023-04-10_000000.log
-rw-rw---- 1 admin root 4.1M Apr 11 00:00 2023-04-11_000000.log
-rw-rw---- 1 admin root 4.9M Apr 12 00:00 2023-04-12_000000.log
-rw-rw---- 1 admin root 5.5M Apr 13 00:00 2023-04-13_000000.log
-rw-rw---- 1 admin root 5.3M Apr 14 00:00 2023-04-14_000000.log
-rw-rw---- 1 admin root 4.4M Apr 15 00:00 2023-04-15_000000.log
-rw-rw---- 1 admin root 4.4M Apr 16 00:00 2023-04-16_000000.log
-rw-rw---- 1 admin root 5.2M Apr 17 00:00 2023-04-17_000000.log
-rw-rw---- 1 admin root 6.7M Apr 18 00:00 2023-04-18_000000.log
-rw-rw---- 1 admin root 8.9M Apr 19 00:00 2023-04-19_000000.log
-rw-rw---- 1 admin root 9.6M Apr 20 00:00 2023-04-20_000000.log
-rw-rw---- 1 admin root 9.3M Apr 21 00:00 2023-04-21_000000.log
-rw-rw---- 1 admin root 9.4M Apr 22 00:00 2023-04-22_000000.log
-rw-rw---- 1 admin root 9.4M Apr 23 00:00 2023-04-23_000000.log
-rw-rw---- 1 admin root 9.4M Apr 24 00:00 2023-04-24_000000.log
-rw-rw---- 1 admin root 8.9M Apr 25 00:00 2023-04-25_000000.log
-rw-rw---- 1 admin root 9.0M Apr 26 00:00 2023-04-26_000000.log
-rw-rw---- 1 admin root 11M Apr 27 00:00 2023-04-27_000000.log
-rw-rw---- 1 admin root 9.3M Apr 28 00:00 2023-04-28_000000.log
-rw-rw---- 1 admin root 8.4M Apr 29 00:00 2023-04-29_000000.log
-rw-rw---- 1 admin root 6.9M Apr 30 00:00 2023-04-30_000000.log
-rw-rw---- 1 admin root 7.0M May 1 00:00 2023-05-01_000000.log
-rw-rw---- 1 admin root 11M May 2 00:00 2023-05-02_000000.log
-rw-rw---- 1 admin root 8.8M May 3 00:00 2023-05-03_000000.log
-rw-rw---- 1 admin root 24M May 4 00:00 2023-05-04_000000.log
-rw-rw---- 1 admin root 50M May 5 00:00 2023-05-05_000000.log
-rw-rw---- 1 admin root 86M May 6 00:00 2023-05-06_000000.log
-rw-rw---- 1 admin root 51M May 7 00:00 2023-05-07_000000.log
-rw-rw---- 1 admin root 57M May 8 00:00 2023-05-08_000000.log
-rw-rw---- 1 admin root 51M May 9 00:00 2023-05-09_000000.log
-rw-rw---- 1 admin root 49M May 10 00:00 2023-05-10_000000.log
-rw-rw---- 1 admin root 55M May 11 00:00 2023-05-11_000000.log
-rw-rw---- 1 admin root 54M May 12 00:00 2023-05-12_000000.log
-rw-rw---- 1 admin root 61M May 13 00:00 2023-05-13_000000.log
-rw-rw---- 1 admin root 61M May 14 00:00 2023-05-14_000000.log
-rw-rw---- 1 admin root 49M May 15 00:00 2023-05-15_000000.log
-rw-rw---- 1 admin root 63M May 16 00:00 2023-05-16_000000.log
-rw-rw---- 1 admin root 60M May 17 00:00 2023-05-17_000000.log
-rw-rw---- 1 admin root 48M May 18 00:00 2023-05-18_000000.log
-rw-rw---- 1 admin root 40M May 19 00:00 2023-05-19_000000.log
-rw-rw---- 1 admin root 36M May 20 00:00 2023-05-20_000000.log
-rw-rw---- 1 admin root 43M May 21 00:00 2023-05-21_000000.log
-rw-rw---- 1 admin root 38M May 22 00:00 2023-05-22_000000.log
-rw-rw---- 1 admin root 33M May 23 00:00 2023-05-23_000000.log
-rw-rw---- 1 admin root 35M May 24 00:00 2023-05-24_000000.log
-rw-rw---- 1 admin root 40M May 25 00:00 2023-05-25_000000.log
-rw-rw---- 1 admin root 42M May 26 00:00 2023-05-26_000000.log
-rw-rw---- 1 admin root 38M May 27 00:00 2023-05-27_000000.log
-rw-rw---- 1 admin root 40M May 28 00:00 2023-05-28_000000.log
-rw-rw---- 1 admin root 40M May 29 00:00 2023-05-29_000000.log
-rw-rw---- 1 admin root 16M May 29 09:47 fw.log
[Expert@QUANTUM-MANAGEMENT:0]#

[flachance]

yes, this is the date I restored. 

[Expert@atsscfwm:0]# ls -lh 2023-04-12*.log
-rw-rw---- 1 admin root 12M Apr 12 00:00 2023-04-12_000000.log
-rw-rw---- 1 admin root 2.0G Apr 12 03:37 2023-04-12_033706_613.log
-rw-rw---- 1 admin root 2.0G Apr 12 07:11 2023-04-12_071114_614.log
-rw-rw---- 1 admin root 2.0G Apr 12 09:00 2023-04-12_090037_615.log
-rw-rw---- 1 admin root 2.0G Apr 12 10:30 2023-04-12_103009_616.log
-rw-rw---- 1 admin root 2.0G Apr 12 12:09 2023-04-12_120934_617.log
-rw-rw---- 1 admin root 2.0G Apr 12 13:50 2023-04-12_135059_618.log
-rw-rw---- 1 admin root 2.0G Apr 12 15:31 2023-04-12_153108_619.log
-rw-rw---- 1 admin root 2.0G Apr 12 17:40 2023-04-12_174020_620.log
-rw-rw---- 1 admin root 2.0G Apr 12 20:45 2023-04-12_204559_621.log
-rw-rw---- 1 admin root 2.0G Apr 12 23:59 2023-04-12_235900.log
[Expert@atsscfwm:0]# pwd
/opt/CPsuite-R81.10/fw1/log

[the_rock]

Would you guys usually have 20 GBs worth of logs in single day? If so, since all those show the same day, can you attach the filter you did in smart console? Lets do remote later if you like and we can confirm.

Andy

[flachance]

Yes 20GB pretty much every working days 😩. I'm opening them manually not the best but it's working.

[Chris_Atkinson]

Did you manually open the log file in question or reindex the logs at all?

[flachance]

I'm manually opening them right now. Is there a way to reindex them?

[the_rock]

Link phoneboy gave is what you need, I had customers do that before and was fine after.

Andy

[PhoneBoy · Accepted solution]

Yes, you need to reindex the old logs.
See: https://community.checkpoint.com/t5/Management/SmartLog-only-look-back-14-days-how-to-reindex-90-day...