Create a Post
Showing results for 
Search instead for 
Did you mean: 

No logs are displayed after installing Database and Endpoint policy management on SMS.

Hi there!
We installed Endpoint policy management on SMS, after which the database was installed.
After that, we are missing logs.
We have blade logging&status enabled.

We checked the following:
SIC status on both nodes Communicating

[Expert@mgmt:0]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current 65G 31G 35G 47% /
/dev/sda1 291M 27M 249M 10% /boot
tmpfs 9.7G 3.9M 9.7G 1% /dev/shm
/dev/mapper/vg_splat-lv_log 215G 208G 7.4G 97% /var/log

[expert@mgmt:0]# netstat -anp | grep -i -E "State|257" //shows STATE ESTABLISHED all interfaces and LISTEN one interface
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0* LISTEN 7678/fwd
tcp 0 0 * * ESTABLISHED 7678/fwd
tcp 0 0 * * ESTABLISHED 8440/cpsemd
Proto RefCnt Flags Type State I-Node PID/Program name Path
unix 3 [ ] STREAM CONNECTED 257798 3051/log_indexer
unix 3 [ ] STREAM CONNECTED 257800 3051/log_indexer
unix 3 [ ] STREAM CONNECTED 257799 3051/log_indexer
unix 3 [ ] STREAM CONNECTED 257801 3051/log_indexer
unix 2 [ ] STREAM CONNECTED 257600 13246/java

Command output on gateways similar to STATE ESTABLISHED and CONNECTED [Expert@mgmt:0]# netstat -anp | grep -i -E "State|257"

[Expert@mgmt:0]# cpprod_util FwIsFireWallModule

[Expert@gw01:0]# cat $FWDIR/conf/masters

when type [Expert@gw01:0]# fw fetch //the output shows: Fetching Security Policy Succeeded

if you enter [Expert@FW]# watch -d -n 1 'ls -l $FWDIR/log/fw.log' //you will see that the log is not increasing

After entering [Expert@MGMT]fw logswitch //logs will not appear.

Reinstalling the database does not help either

Can you tell me how I can get the logs back?

0 Kudos
1 Reply

A few more commands to check the status of logging:

On the Security Gateway cpstat fw -f log_connection

On the Security Management cpstat mg -f log_server and cpstat mg -f indexer


As a W/A I would also try to stop and start the Security Management Server.

0 Kudos


Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events