CheckPoint Index Logs

[katsarasd]

Hello CheckMates,

We are observing that the Log Indexer on our R81.20 Management Server (Take 118) is not automatically deleting old index folders, despite the retention policy being configured to remove index logs older than one day. All related services, including SMARTLOG_SERVER, SOLR, and INDEXER, are running normally, and new logs continue to be indexed correctly. However, the old index folders continue to accumulate, consuming significant disk space. Does anyone have faced this issue ?

Regards

[the_rock]

How is log tab configured on the mgmt object in smart console? Can you send a screenshot?

[katsarasd]

Hello @the_rock 

Please see attached. 

Thanks

[the_rock]

Make sure to install database after that change, if you have not already. If you have, then try cprestart or reboot.

[Shyy]

Have you tried to restart the log indexer service?

Plus make sure the retention policy you've configured is the same value as the actual log indexing time itself.

[katsarasd]

Hello @Shyy yes, i've tried that with no luck

[Shyy]

Hey,
If your new index logs are being deleted correctly, and the issue is only the old ones before the retention configuration,
maybe look at deleting them manually?

[katsarasd]

Hello @Shyy 
I've tried that with no success.

[Shyy]

You were no able to delete the old index files? or new index files are also not being deleted?
there's no reason you won't be able to delete manually the old files

[katsarasd]

I've deleted the old index files after the retention policy change, afterwards i've observed that the new created index logs are not being automatically deleted.

Regards

[Shyy]

If you've done all of these and made sure your config is indeed to delete after 1 day
Logs >> Storage >> "Delete index files older than"
Then for sure open a TAC case.

[Don_Paterson]

You could try to set the last filed to 0

Then Piblish and Install database. 

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_LoggingAndMonitoring_AdminGuide/Co...

You could also try evstop and evstart to restart all log server components. 

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_CLI_ReferenceGuide/Content/T...

[Don_Paterson]

"You could try to set the last filed to 0

Then Piblish and Install database. 

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_LoggingAndMonitoring_AdminGuide/Co...

You could also try evstop and evstart to restart all log server components. 

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_CLI_ReferenceGuide/Content/T...

"

@katsarasd  Did this look like good options? ☝️

[Ruan_Kotze]

Lots of good suggestions already.

Also confirm that the "days to index" setting in '$INDEXERDIR/log_indexer_custom_settings.conf' matches what is configured in SmartConsole.  If not, adjust it with the following command:

[Expert@HostName:0]# cd $INDEXERDIR
[Expert@HostName:0]# ./log_indexer -days_to_index 150

Of course replace 150 with whatever is relevant in your scenario.

[the_rock]

This should be the right command:

$INDEXERDIR/log_indexer -days_to_index 150 /opt/CPrt-R82/log_indexer/ -workingDir $INDEXERDIR/

[Ruan_Kotze]

Interesting.  The one I posted has always worked for me.

[the_rock]

Is it R81.20? Cause my lab mgmt is R82

[katsarasd]

Hi Everyone,

Sorry for my late response. I've opened a TAC case and they suggested us to follow this sk183148. We've made our changes yesterday and we'll monitor how this is going to work. I'll let you know about the results. Thanks for the support.

Regards

[the_rock]

I cant seem to find that sk in support site.

[the_rock]

Nm, found it, its this sk:

Some old indexes are not removed from /opt/CPrt-R8X.X/log_indexes/ despite log retention settings in SmartConsole