Log server indexing

[Ihenock1011]

Hi All,

I have a Check Point R81.10 Security Gateway and a Smart-1 SMS server, which is used as a log server as well. We are facing CPU spike issues, and we have disabled log indexing on these log servers. Now, when we view the logs, it displays something to the picture below. What does log indexing mean, and does the picture indicate any issues?

Regards,

[Alex-]

Without the indexes, you're reading the flat log files and need to manually open them, also the log search will be slower due to, well, no indexing. Latest log file is fw.log, so the active file.

Indexing is much more practical as you can search any indexed value over all files and as such, it is worth spec'ing up your SMS to support indexing if you have the ability to do so.

[PhoneBoy]

This is expected behavior.
Without log indexing enabled, you will only be able to search the currently opened log file.
A new one is created every 24 hours or 2GB of data (whichever comes first).

Note that log indexing is set at the lowest system priority, so it should not interfere with other processes.