- Local User Groups
Sometimes my Smartview or SmartEvent (at smart console) try query for show data in these dashboard and result me Query Failed. I tried procedures in sk114133 but no efects on my Event Server.
Do you have any Ideia where can I starts debug or find solution for this problem?
APP PID STAT #START START_TIME MON COMMAND
CPVIEWD 20993 E 1 [16:13:37] 1/11/2017 N cpviewd
CPD 21011 E 1 [16:13:38] 1/11/2017 Y cpd
FWD 21089 E 1 [16:13:41] 1/11/2017 N fwd -n
FWM 21092 E 1 [16:13:41] 1/11/2017 N fwm
SOLR 22370 E 3 [18:18:44] 1/11/2017 N java_solr /opt/CPrt-R80/conf/jetty.xml
CPM 21356 E 1 [16:13:42] 1/11/2017 N /opt/CPsuite-R80/fw1/scripts/cpm.sh -s
RFL 7584 E 1 [17:15:06] 1/11/2017 N LogCore
SMARTVIEW 7625 E 1 [17:15:06] 1/11/2017 N SmartView
INDEXER 7679 E 1 [17:15:06] 1/11/2017 N /opt/CPrt-R80/log_indexer/log_indexer
SMARTLOG_SERVER 7723 E 1 [17:15:06] 1/11/2017 N /opt/CPSmartLog-R80/smartlog_server
CPSEMD 7894 E 1 [17:15:07] 1/11/2017 Y cpsemd
CPSEAD 7897 E 1 [17:15:07] 1/11/2017 N cpsead
DASERVICE 21750 E 1 [16:13:46] 1/11/2017 N DAService_script
CPSM 25774 E 1 [16:16:37] 1/11/2017 N cpstat_monitor
My thoughts exactly, looks like the SOLR process crashed and got restarted. There should be a core dump in /var/log/dump/usermode that can help Check Point support figure out what went wrong with the SOLR process.
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.
So, we've been using some old retired hardware to do security check ups for customers and have had this problem. It seems to be related to the amount of RAM available. To get around the problem initially, we did the same as Tom by disabling the indexing, pushing policy, re-enabling indexing and pushing policy. A longer term fix seems to be to add more RAM - problem hasn't come back after that.
These errors can be also seen in R80.10 SmartView widgets (Top Sources, Top Destinations etc.) in a clean DB setup - where performance matters or amount of RAM available were not the triggers.
The cause was an issue with the content of $RTDIR/smartview/db//controls.xml
A Secure Knowledge article will be written soon and will be found by searching for "Query failed error in R80.10 Smart View widgets"