Error: FW-1 failed to generate the Delayed log record.

[Alexander]

Hi everyone,

With a checkpoint clusterXL security gateway (R80.20;2.6.18-92cpx86_64), after installing the following hot fix <Check_Point_R80_20_JUMBO_HF_Bundle_T33_sk137592_GL_FULL.tgz> no logs are being generated and I can see the following errors in /var/log/messages :

Jun 26 10:37:03 2019 fw01 kernel: FW-1: stopping debug messages for the next 57 seconds

Jun 26 10:37:03 2019 fw01 kernel: [fw4_0];fwloghandle_create: FW log format error (124). Please check your log formats files (*.lf).

Jun 26 10:37:03 2019 fw01 kernel: [fw4_0];Error: FW-1 failed to generate the Delayed log record.

Jun 26 10:37:03 2019 fw01 kernel: [fw4_0];[10.255.253.237:63420 -> 239.255.255.250:1900] [ERROR]: up_unified_log_send_network_chain_log: fw_up_fw_delayed_log_conn_ex (via hook) failed

Jun 26 10:37:03 2019 fw01 kernel: [fw4_0];[10.255.253.237:63420 -> 239.255.255.250:1900] [ERROR]: up_manager_create_net_log: up_unified_log_send_network_chain_log failed

Jun 26 10:37:03 2019 fw01 kernel: [fw4_0];fwloghandle_create: FW log format error (124). Please check your log formats files (*.lf).

I verified sk121612 and sk117288  and output is as expected, although the solutions are respectively for R77.30 and R80.10.

Anyone else an idea what can be done to verify what's going on ?

many thanks

Alexander

[PhoneBoy]

You might check this SK: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
If that doesn't help, I'd open a TAC case.

[Alexander]

Seen this SK as well however that config is not changed and is as mentioned in the SK. However I uninstalled the JUMBO HF pack and logging was working again 😕

[PhoneBoy]

Then you definitely should involve the TAC.