Reboot CP Log Server during production

[seanmc12]

I have 2 HA 6500 CP firewalls, a management server and a separate physical log server. I upgraded my management server from R80.40 to R80.10 with no issues. I started the upgrade of the Log server from R80.40 to R80.10, but its been stuck at "Process Initializing" for 4 days now. I've called TAC and they are saying to sit and wait until it fails. But its been running now, supposedly, for 4 days. They asked me to reboot the log server, but couldn't tell me if I could do that during the day without impacting anything. I know that during the reboot of the log server, I won't be able to capture logs, but other than that, is there any risk to rebooting the CP log server during the day? Will it reconnect to the Firewalls after the reboot? Should I be concerned ?

[Wolfgang · Accepted solution]

If your gateways can't reach the logserver they will be logging locally. Best case before reboot will be to use your Managementserver additional as logserver. Your gateways can send the logs to both machines or if one is failing use the other. If you reboot your logserver the gateways will be working fine,  exception of not sending the logs.

[seanmc12]

Thank you for that information. That is what I was thinking as well. It concerns me that TAC could not confirm this. I'm not an expert and just need some reassurance on things. The documentation for some of this can be less than stellar.

[Chris_Atkinson]

Normally it should not be a problem but if you have an incomplete upgrade process running this is not a normal scenario. 

How does the space on the machine look?

Do you have backups of the server/logs in case recovery is required?