SmartEvent Server Crashed and rebuilt - Missing Rule base and Logs

[RichUK]

Hi all,

Apologies first of all, I have recently took over the firewall management and still learning.

We have a management and a smartevent server running R81.10, both VM's. In an attempt to fix another issue, both the management and smartevent server had the latest JF take installed. The management server installed the patch and rebooted, the smartevent server never recovered from the reboot (it was left for hours).

As the smartevent server is backed up, I rebuilt it. There were two attached drives, one 700GB and one 7TB, I selected the 700GB for the OS and all was good.

After Gaia became available, I did the Gaia restore and reset the SIC communication. The smartevent server is showing in the Smart Console now, but I have two issues.

1. The smartevent rule base is gone. I would have thought this was part of the database or in the backup file?

2. I've lost all my historic logs.

For the logs, I suspect the 7TB drive was specifically for the logs. We have recently had to adjust the disk space management of the management server because of the logs filling it up (4TB), does this mean that logs are both on the management and smart event server?

I've tried to follow https://community.checkpoint.com/t5/Management/How-to-add-a-new-disk-and-expand-the-log-file-system/... 

parted -l shows the following

Model: VMware Virtual disk (scsi)
Disk /dev/sda: 752GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number Start End Size File system Name Flags
1 17.4kB 315MB 315MB ext3 boot
2 315MB 752GB 751GB lvm

Model: VMware Virtual disk (scsi)
Disk /dev/sdb: 7697GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number Start End Size File system Name Flags
1 17.4kB 59.2GB 59.2GB linux-swap(v1) boot
2 59.2GB 7697GB 7637GB lvm

and lvs -o +devices shows

LV VG Attr LSize Pool Origin Data% Meta% Move Log Cpy%Sync Convert Devices
lv_current vg_splat -wi-ao---- 32.00g /dev/sdb2(0)
lv_log vg_splat -wi-ao---- 800.00g /dev/sdb2(1024)

Can anyone help?

[G_W_Albrecht]

Usually, in VMware a snapshot is made before performing updates or HF installs, as that makes it very easy to change back to the old working VM containing the same data as before. For more disk space i would suggest to follow sk94671: How to add hardware resources, such as log storage, to a Virtual Machine running Gaia OS instead !

[RichUK]

Thank you, I'll have a read of that article.

Any ideas about the smart event rules missing?

[G_W_Albrecht]

No - i would contact CP TAC to resolve this issue or at least get an explanation.