Checkpoint R81.20 Logging Issue

[SuchitSrivastav]

Hi CheckMates,

I have recently upgraded my Checkpoint Management Server from R80.30 to R81.20. So far, things looks good but I've started facing issue with Logging. When I open Logs&Monitor tab, in Logs I'm not able to see the Logs itself. To see the logs I've to open the specific log file. I've enabled log indexing etc. and my logging partition has more than 2TB space that should not be something with space.

I've detached & attached the log server from multiple gateways, just for testing purpose but no luck.

Any leads can suggest urgently if you've seen such issues? I've logged a TAC case but they told me this is something new issue for them too with R81.20.

PS: I'm aware that old log index wouldn't be upgraded in R81.x. I'm referring here about new log files that is being created post upgrade.

Thank you!!

[Blason_R]

I personally do not have experience on R81.20 hence did not want to jump to this issue. However going through the conversation since the logs are being observed in cplgv then its a indexing issue for sure. What does your solr.elg file says? Any exceptions?

[the_rock]

Lets wait for @SuchitSrivastav to confirm if what he tried yesterday worked or not. But generally, I agree with all you said 100%. TAC engineer gave me this sk when customer had similar issue last year. @SuchitSrivastav , maybe worth a try?

Andy

Able to view and open log files from legacy SmartView Tracker, but unable to view log files from Sma...

 

[Liat_Cihan]

We seem to have found the problem and it has nothing to do with R81.20. It lies in the DB (IP conflict).
@SuchitSrivastav - we will contact you with the solution.

[the_rock]

I knew you would find the problem! Amazing work as always.

[SuchitSrivastav · Accepted solution]

Hi Guys,

Apologies, I'm posting late here. Issue has been resolved now with help of TAC. 

Yep, it was IP confliction between two log servers. Since each log has a field named irg_log_server that is the uuid of the LS that indexed the log. When RFL get a log it verifies that a LS with the same UUID exists in the file $RTDIR/conf/logServerConfig.xml/ which in this case included only a single LS. In such case, RFL discards the logs with that orig_log_server value since it cannot find in it configuration files any LS with such UUID. 

After restarting log_indexer the configuration files were rebuilt and logs are seen.

Thank you everyone for your support and suggestions. 

Happy New Year to all in advacne! 

[the_rock]

Awesome news!

[rboettger]

Hi, I also updated today out Management/Logserver from R81.10 to 81.20. The only thing, which isn't working as expected is to view Logs via Browser (https://MGMT-IP/smartview/). Immediately, 'Query failed' occurs. After the update, I have performed 'cpstop' & 'cpstart' without change the behaviour. I've read also about a bit about $RTDIR/conf/logServerConfig.xml, this file looks as follows.

Any advises?

[Expert@MGMT:0]# cat /opt/CPrt-R81.20/conf/logServerConfig.xml
<?xml version="1.0"?>
<config>
<connection>
<IPAddress>MGMT-IP</IPAddress>
<IsLocalIp>true</IsLocalIp>
<SSL>false</SSL>
<Port></Port>
<LoopbackPort>18244</LoopbackPort>
<CPUUID>629e4263-bebf-3d41-be9d-bd6b11a0237b</CPUUID>
<IsSmartEvent>false</IsSmartEvent>
<IsPrimaryManagement>true</IsPrimaryManagement>
<ProxyPort>8211</ProxyPort>
<ProxyIp>MGMT-IP</ProxyIp>
</connection>
</config>

[rboettger]

Update: Today, Logs are seen under https://MGMT-IP/smartview/

After yesterday's upgrade, I've enabled in SmartConsole Log Indexing and today logs are seen in SmartView