Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Rafael_Morato
Participant

Database Smartevent Query Failed

Hi CheckMates, 

   Sometimes my Smartview or SmartEvent (at smart console) try query for show data in these dashboard and result me Query Failed. I tried procedures in sk114133 but no efects on my Event Server. 

 

Do you have any Ideia where can I starts debug or find solution for this problem?

Thanks.

11 Replies
Libin_Thomas
Contributor

check cpwd_admin list , may be solr process is terminated you can do debug on solr process or do a evstart

0 Kudos
Rafael_Morato
Participant

So,

That running

cpwd_admin list
APP PID STAT #START START_TIME MON COMMAND
CPVIEWD 20993 E 1 [16:13:37] 1/11/2017 N cpviewd
CPD 21011 E 1 [16:13:38] 1/11/2017 Y cpd
FWD 21089 E 1 [16:13:41] 1/11/2017 N fwd -n
FWM 21092 E 1 [16:13:41] 1/11/2017 N fwm
SOLR 22370 E 3 [18:18:44] 1/11/2017 N java_solr /opt/CPrt-R80/conf/jetty.xml
CPM 21356 E 1 [16:13:42] 1/11/2017 N /opt/CPsuite-R80/fw1/scripts/cpm.sh -s
RFL 7584 E 1 [17:15:06] 1/11/2017 N LogCore
SMARTVIEW 7625 E 1 [17:15:06] 1/11/2017 N SmartView
INDEXER 7679 E 1 [17:15:06] 1/11/2017 N /opt/CPrt-R80/log_indexer/log_indexer
SMARTLOG_SERVER 7723 E 1 [17:15:06] 1/11/2017 N /opt/CPSmartLog-R80/smartlog_server
CPSEMD 7894 E 1 [17:15:07] 1/11/2017 Y cpsemd
CPSEAD 7897 E 1 [17:15:07] 1/11/2017 N cpsead
DASERVICE 21750 E 1 [16:13:46] 1/11/2017 N DAService_script
CPSM 25774 E 1 [16:16:37] 1/11/2017 N cpstat_monitor

0 Kudos
PhoneBoy
Admin
Admin

How much RAM is on your SmartEvent server?

0 Kudos
Timothy_Hall
Champion
Champion

My thoughts exactly, looks like the SOLR process crashed and got restarted.  There should be a core dump in /var/log/dump/usermode that can help Check Point support figure out what went wrong with the SOLR process.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos
Jason_Dance
Collaborator

I agree, having enough RAM assigned plays a big part in the stability of SmartEvent.

0 Kudos
Tom_Coussement
Contributor

Had the same issue. 

After disabling smart indexing and re-enabling, the issue was solved

0 Kudos
(1)
Tiago_de_Souza_
Explorer

Hi Tom!

I'm get the same issue, but just for one user... how to disable and re-enable smart indexing?

0 Kudos
Stuart_Green
Collaborator

So, we've been using some old retired hardware to do security check ups for customers and have had this problem. It seems to be related to the amount of RAM available.  To get around the problem initially, we did the same as Tom by disabling the indexing, pushing policy, re-enabling indexing and pushing policy.  A longer term fix seems to be to add more RAM - problem hasn't come back after that.

0 Kudos
Orel_Vanounou
Employee
Employee

These errors can be also seen in R80.10 SmartView widgets (Top Sources, Top Destinations etc.) in a clean DB setup - where performance matters or amount of RAM available were not the triggers.

The cause was an issue with the content of $RTDIR/smartview/db//controls.xml

A Secure Knowledge article will be written soon and will be found by searching for  "Query failed error in R80.10 Smart View widgets"

Sven_Glock
Advisor

Hi Orel,

 

I did not find the promised SK. Is it already public? 🤗

 

Btw: I experienced the same issue with R80.20

 

Cheers

Sven

 

0 Kudos
Sven_Glock
Advisor

In my case restarting log indexing solved the issue...

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events