cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post
Highlighted

Database Smartevent Query Failed

Hi CheckMates, 

   Sometimes my Smartview or SmartEvent (at smart console) try query for show data in these dashboard and result me Query Failed. I tried procedures in sk114133 but no efects on my Event Server. 

 

Do you have any Ideia where can I starts debug or find solution for this problem?

Thanks.

11 Replies

Re: Database Smartevent Query Failed

check cpwd_admin list , may be solr process is terminated you can do debug on solr process or do a evstart

0 Kudos

Re: Database Smartevent Query Failed

So,

That running

cpwd_admin list
APP PID STAT #START START_TIME MON COMMAND
CPVIEWD 20993 E 1 [16:13:37] 1/11/2017 N cpviewd
CPD 21011 E 1 [16:13:38] 1/11/2017 Y cpd
FWD 21089 E 1 [16:13:41] 1/11/2017 N fwd -n
FWM 21092 E 1 [16:13:41] 1/11/2017 N fwm
SOLR 22370 E 3 [18:18:44] 1/11/2017 N java_solr /opt/CPrt-R80/conf/jetty.xml
CPM 21356 E 1 [16:13:42] 1/11/2017 N /opt/CPsuite-R80/fw1/scripts/cpm.sh -s
RFL 7584 E 1 [17:15:06] 1/11/2017 N LogCore
SMARTVIEW 7625 E 1 [17:15:06] 1/11/2017 N SmartView
INDEXER 7679 E 1 [17:15:06] 1/11/2017 N /opt/CPrt-R80/log_indexer/log_indexer
SMARTLOG_SERVER 7723 E 1 [17:15:06] 1/11/2017 N /opt/CPSmartLog-R80/smartlog_server
CPSEMD 7894 E 1 [17:15:07] 1/11/2017 Y cpsemd
CPSEAD 7897 E 1 [17:15:07] 1/11/2017 N cpsead
DASERVICE 21750 E 1 [16:13:46] 1/11/2017 N DAService_script
CPSM 25774 E 1 [16:16:37] 1/11/2017 N cpstat_monitor

0 Kudos
Admin
Admin

Re: Database Smartevent Query Failed

How much RAM is on your SmartEvent server?

0 Kudos

Re: Database Smartevent Query Failed

My thoughts exactly, looks like the SOLR process crashed and got restarted.  There should be a core dump in /var/log/dump/usermode that can help Check Point support figure out what went wrong with the SOLR process.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

"IPS Immersion Training" Self-paced Video Class
Now Available at http://www.maxpowerfirewalls.com
0 Kudos
Jason_Dance
Copper

Re: Database Smartevent Query Failed

I agree, having enough RAM assigned plays a big part in the stability of SmartEvent.

0 Kudos

Re: Database Smartevent Query Failed

Had the same issue. 

After disabling smart indexing and re-enabling, the issue was solved

0 Kudos

Re: Database Smartevent Query Failed

Hi Tom!

I'm get the same issue, but just for one user... how to disable and re-enable smart indexing?

0 Kudos

Re: Database Smartevent Query Failed

So, we've been using some old retired hardware to do security check ups for customers and have had this problem. It seems to be related to the amount of RAM available.  To get around the problem initially, we did the same as Tom by disabling the indexing, pushing policy, re-enabling indexing and pushing policy.  A longer term fix seems to be to add more RAM - problem hasn't come back after that.

0 Kudos
Employee
Employee

Re: Database Smartevent Query Failed

These errors can be also seen in R80.10 SmartView widgets (Top Sources, Top Destinations etc.) in a clean DB setup - where performance matters or amount of RAM available were not the triggers.

The cause was an issue with the content of $RTDIR/smartview/db//controls.xml

A Secure Knowledge article will be written soon and will be found by searching for  "Query failed error in R80.10 Smart View widgets"

Sven_Glock
Silver

Re: Database Smartevent Query Failed

Hi Orel,

 

I did not find the promised SK. Is it already public? 🤗

 

Btw: I experienced the same issue with R80.20

 

Cheers

Sven

 

0 Kudos
Sven_Glock
Silver

Re: Database Smartevent Query Failed

In my case restarting log indexing solved the issue...

0 Kudos