Reports generation for older logs

[sandeepsutar]

Hello Experts,

I have enabled the SmartEvent and Correlation blades today. However, my requirement is to generate a report for the last week.

All logs (for the past 90 days) and indexed logs are available on the same management server — this is also where the SmartEvent blade is enabled. The management server collects logs from all remote-location firewalls.

Currently, when I generate a report, it only shows data from today.

Is there anything else I need to configure or perform (such as reprocessing logs) to include data from the previous week in the report?

The goal is to generate a 1-week report for a specific remote location.

Regards,

[Chris_Atkinson]

Please review the available knowledge articles such as sk111766.

[the_rock]

I have dedicated smart event in R82 lab. Is this for specific blade you are trying to do? I can easily try see if I can make it work.

[PhoneBoy]

Check on your management object if this setting is enabled:

If it was not enabled by default, you probably did not install enough RAM in your management/SmartEvent system.
At least 8GB is needed for a small lab (much more for production).

If this setting is disabled, you will only be able to work with one log at a time, which covers at most a 24 hour period (starting at midnight).

[Blason_R]

I guess he is mentioning about a report for specific firewall? Is that so? else creating a report is pretty simpler and straight forward task

[Amir_Senn]

Log indexing for "regular" log use and Indexing for SmartEvent is not the same.

SmartEvent indexing is heavier and more resource consuming. In order to produce SmartEvent reports, those will need to be indexed again.

[sandeepsutar]

Hello,

I followed SK111766 on October 28th at 10 AM and reindexed the logs for the last 14 days, but unfortunately, there’s still no success.

When I check the $RTDIR/log_indexes directory, it only shows entries starting from smartevent_2025-10-25T12-00-00 — which corresponds to the date when the SmartEvent blade was enabled.

It appears that the reindexing process did not generate the SmartEvent index files for the earlier dates.
Is there any way to generate these indexes manually?

Note: The objective is to generate a 1-week report (October 19th–24th) for a specific remote location.

Regards,

[emmap]

From what you've said it sounds like you enabled the blades on the existing management server that has already indexed the log files before SME was enabled. As it says in the SK, "The solution procedure below will not work properly if the files that need to be re-indexed are already listed as indexed."

You will need to follow the linked SK to reindex the log files you wish to run reports on, from before you enabled SmartEvent. Anything since the enabling is fine and does not need to be reindexed.

https://support.checkpoint.com/results/sk/sk164553