Log unification error – too many update log, logs has been truncated

[Michael_Horne]

Hello,

I have an ongoing issue with a "log unification error" for R80.10.  By research has found:

• I see then mentioned in one other area in CheckMates, CheckPoint Firewall R80.10 stability issues , but I see not information here about any explanation. 
• Other searches have mentioned a relationship in R77 with using an IPS Protection policy other than the "default". I tried to disable the IPS blade on one of the affected security gateway cluster, but this did not stop the logs unifcation error messages
• I also find a mention of unification isues when using the Log exporter:  https://community.checkpoint.com/message/24572-re-log-exporter-guide?commentID=24572#comment-24572 and we are using the log exporter.

What I am seeing in the Logs and Monitoring view the following:

I am not seeing any issues with load on the Management server.

Does anyone else have any experiences with this issue that they could share?

Many thanks,

Michael

[Cody_Von_Seelen]

Noticing this in R80.20 on an MDS environment, unable to find much documentation to support if this is an issue or just too many logs that match this UUID. How is this cleared as it is showing up on many logs 

[hrath]

Were you able to fix this error ? 

[Cody_Von_Seelen]

This ended up having 2 separate "resolutions" The message cleared on Threat Emulation Logs when we updated to Threat Engine Update 8.7 last year in August. The Message seen on HTTP Traffic was stated that it has no environmental impact and is unable to be cleared. The limitation of updates to the log is 500 updates by design. The error "Log Unification Error: Too Many Updates logs, log has been truncated" indicates the deviation in the number of updates, over 500. You can private message me if you would like the cases for reference.