There's no traffic Log in SmartConsole

[faruq1223]

Dear All,

We faced an issue where there no traffic log in smartconsole

I have Follow this SK to tshoot, everything looks okay
https://support.checkpoint.com/results/sk/sk38848

This is My finding about the issue
1. The issue will solve with install policy. if i make dummy object or rule and install policy the issue solve
2. This is the output from "cpstat mg -f log_server"

3. I found disk issue log issue. login appears during the issue and login is generated at 1 hour interval. need confirmation whether this is the cause of the issue or not. 

I need a clue for this issue, I still haven't found why this is happening.

Thanks,

[Lesley]

Please share:

SmartConsole -> mgmt object -> Logs -> local storage

I think it gives an error BEFORE it removes old logs. I see many people configure it the other way around 

[faruq1223]

Dear Lesley,

I actually noticed that, But is the full disk notification the cause of the loss of traffic logs?
because 1 full day the Log is only like the picture in the post


Thanks,

[the_rock]

Run this on the fw, if it shows ANYTHING other than 8.2K, fw is logging locally and thats your issue.

Andy

watch -d ls -lh $FWDIR/log/fw.log (ctrl+c to stop)

If thats the case, then follow below sk to try and solve the problem.

https://support.checkpoint.com/results/sk/sk40090

[faruq1223]

Dear the_rock,

The output showing 8.2K

Thanks,

[the_rock]

Thats good then, so might be easy solution as rebooting your mgmt server. Once rebooted, run watch -d $FWDIR/scripts/./cpm_status, wait till shows up and ready, then ctrl+c to stop, then run api status, make sure shows successful, log into smart console and hopefully all the logs will be there.

Let us know.

Andy

[Amir_Senn]

If you don't have local logging but you don't see the logs in the logs view you might have an indexing issue.

You can verify it easily by opening a log file manually and see if you see the logs.