show-notifications api spam

[Henrik_Noerr1]

Hey,

I have had a SR open regarding spam in api.elg (r82 latest jhf)

When an admin is connected to smart console also via web - the client queries the management server api endpoint /show-notifications - this happens every 800ms for each smc session with a policy opened also in read-only sessions

We are a busy shop with some 60 open sessions at a time giving a massive flood in the logs.

This has not always happened, and unsure when it started. However now it is absolutely impossible to tail or track errors in api.elg.

Does anyone know if it is possible to stop this excessive polling? TAC has not been very helpful here, and have gotten a simple /wontfix.

/Henrik 

[Tal_Paz-Fridman]

Hi @Henrik_Noerr1 

Where do you see the massive flood in logs? Can you share a screenshot?

Thanks

[Henrik_Noerr1]

I see it in api.elg

[Expert@mds-01:0]# tail -f /var/log/opt/CPsuite-R82/fw1/log/api.elg | grep show-notif

2026-09-07 09:51:32,540 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3372074] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,313 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373146] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,314 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3372603] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,324 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373667] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,324 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373666] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,334 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373134] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,335 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3369857] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,345 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3372074] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,346 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373146] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:33,355 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3372603] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:34,132 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373146] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:34,134 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3372603] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:34,142 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3372098] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:34,145 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373667] - Executing [show-notifications] of version [2.0.1] (references 1.7)
Address: http://localhost/web_api/show-notifications
2026-09-07 09:51:34,153 INFO com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:781 [qtp-443701149-3373666] - Executing [show-notifications] of version [2.0.1] (references 1.7)

[Shyyyy]

Hey,
Check point web smart console is api dependent, which means everything you're doing there is running an api in the background.
Not sure if there's a way to reduce it.
but why would that affect error tracking? you can use grep to track them a lot better.

[Henrik_Noerr1]

sure I use grep all the time for this, my grief is the flood which makes proactive error tracking and learning impossible.

Exactly why the api no longer floods the api.elg with the result of a query - it was unnecessary and redundant.

We are peaking at around 614 requests - per second

This translates to around 8500 lines of log per second.

[Tal_Paz-Fridman]

Hi @Henrik_Noerr1 

I have forward your post to the relevant owner in R&D. 

Thanks

Tal

[Tal_Paz-Fridman · Accepted solution]

Hi @Henrik_Noerr1 

According to R&D we have the I/S to fix the issue and it will be handled in a future release (not sure which)

Thank you for bringing this up!

Tal

[Vincent_Bacher]

Just searched a bit around and found file $MDS_FWDIR/conf/log4j2.xml (on SMS use $FWDIR instead).
This config seems to be scanned every 5 secs so from my understanding modifications take effect automatically.

In this file I see following settings

        <!-- API Logs -->
        <Logger name="com.checkpoint.management.web_api" level="info" additivity="false">
            <AppenderRef ref="ApiAppender"/>
        </Logger>
        <Logger name="com.checkpoint.management.web_api_is" level="info" additivity="false">
            <AppenderRef ref="ApiAppender"/>
        </Logger>

So I would try and (for sure after creating backup) modify like this to set the log level to warn.

        <!-- API Logs -->
        <Logger name="com.checkpoint.management.web_api" level="warn" additivity="false">
            <AppenderRef ref="ApiAppender"/>
        </Logger>
        <Logger name="com.checkpoint.management.web_api_is" level="warn" additivity="false">
            <AppenderRef ref="ApiAppender"/>
        </Logger>

Fair?

[Henrik_Noerr1]

thanks!