Unable to export database for upgradation from R77.30 to R80.x

[Blason_R]

Hi Team,

This is Smart-210 appliane with R77.30 and it had previously EPM+smart Management enabled on single box. Even we had on-prem DOCS configured so this appliance was configured as a Reverse Proxy server.

Now we finally would like to take a upgrade job and facing hell lot of challenges while upgrading.

We even not able to the take database out and giving below errors. And while installing HFA is givining lot of dependency errors.

Any help is appreciated.

[PhoneBoy]

In that output, there is one license error and something about manual changes to implied_rules.def.
Neither of those should prevent an upgrade.
So what's the precise error you get when you run migrate export?
You may want to get the TAC involved also.

[Blason_R]

I will involve the TAC but thought community might help. Something is terribly wrong with my installation I believe.

This is I am getting with puv script

./pre_upgrade_verifier -p $FWDIR -c R77 -t R80.40 -f xxxx-xxx.txt
ReadFwsetFromSqlFile: 2 Error reading from database for file /opt/CPsuite-R77/fw1/conf/grc_test_elements.sqlite. Error is:

And then

more /opt/CPsuite-R77/fw1/conf/grc_test_elements.sqlite.
/opt/CPsuite-R77/fw1/conf/grc_test_elements.sqlite.: No such file or directory

Surprisingly this is not even generating puv output.

[Blason_R]

Looks like compliance blade issue. I disabled the compliance balde, isntalled the database and see what happens. 

Any way I found sk112000 is that relevant to management server as well?

[PhoneBoy]

Don't believe so if it's not MDM.

[Blason_R]

No luck - Any ways need to go to CCSP and then to GTAC thats a long route. All the upgrade options are failing.

[shlomip]

Hi @Blason_R ,

It could be that grc_test_elements.sqlite was updated during the PUV's execution. Retry after doing cpstop before the PUV and before the export.

If it still fails again open a support ticket together with latest $CPDIR/log/migrate*.log file

[Blason_R]

Hello,

Thanks already opened but that is through ccsp support partner and I am sure it will take much time to reach to GTAC. again I dont think ccsp will be able to resolve. Hence I decided to ask community.

[Blason_R]

Is this causing an issue?

Capsule Docs DLP Add-on

Endpoint Security Management R77 Plug-in

Is of is there a way to uninstall it? and then I can give a try?

[Blason_R]

Hello,

So per this sk113602 - It would not be possible to upgrade the Management server from R77.30.03 to R80.xx. There is no any other alternative to at least take a database or rule base.

Since I am managing around 5 firewalls and multiple policies it would be very difficult to re-create the entire Mgmt server.

Any other alternative?

[Oren_Shalgi]

Hi,

The SK you have mentioned is about no upgrade to R80.10 - is that what you are attempting to do?

Upgrade to R80.20/R80.30/R80.40 is fully supported.

If still in trouble, I suggest you would contact Check Point Support for assistance.

Thanks,

Oren.

[Blason_R]

Hi Oren,

sk113602 is exactly my scenario - Where currently I am on R77.30.03 and Capsule DOCS is installed [ though customer is not using right now] and it had EPM enabled again we disabled it since customer has stopped working DOCS/Workspace.

Per sk fwm ver is absolutely same and puv just fails even ./migrate export does not work. Hence wondering if there are no other option?

Thanks

[Oren_Shalgi]

Hi,

Which management version are you trying to upgrade to?

Oren.

[Blason_R]

Preferably to R80.30. 

Does that mean that SK was only applicable to when you are migrating to R80.10?

[Oren_Shalgi]

Yes.

If you encounter issues when attempting an upgrade to R80.30, please contact Check Point Support to take a closer look at your issue.

Thanks,

Oren.

[Blason_R]

Thanks for the confirmation. I am already with them.

[Kiril_Kaper]

Hi,

Please share your Service Request number privately.

Thank you

[Blason_R]

I sent some information in private.  Would request you to please check and confirm.

[Blason_R]

Here are the error logs if someone needs to have a look at it? I just tried to run R80.40 verifier from CPUSE and it failed.

[IdanC · Accepted solution]

Update: Resolved by sk112000

[Blason_R]

Thanks a ton Idan for your help and much appreciated.

Here is the complete information if in case anyone interested.

#######

[Expert@xxxxxx:0]# sqlite3 /opt/CPsuite-R77/fw1/conf/grc_controls.sqlite
SQLite version 3.6.20
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> delete from grc_controls;
sqlite> .quit
[Expert@xxxxxx:0]# sqlite3 /opt/CPsuite-R77/fw1/conf/grc_test_elements.sqlite
SQLite version 3.6.20
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> delete from grc_test_elements;
Error: database disk image is malformed
sqlite> .quit

##################
[Expert@xxxxxx:0]# sqlite3 grc_test_elements.sqlite
SQLite version 3.6.20
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> pragma integrity_check;
*** in database main ***
On tree page 1392 cell 0: 1 of 4 pages missing from overflow list starting at 970
On tree page 1392 cell 2: 2nd reference to page 948
On tree page 2522 cell 0: 2nd reference to page 1032
On tree page 2572 cell 100: 2nd reference to page 1378
On tree page 2572 cell 100: Child page depth differs
On page 2572 at right child: 2nd reference to page 2434
On tree page 994 cell 3: 2nd reference to page 478
On tree page 994 cell 3: Child page depth differs
On tree page 994 cell 4: Child page depth differs
On tree page 994 cell 14: 2nd reference to page 476
On tree page 994 cell 14: Child page depth differs
On tree page 994 cell 15: Child page depth differs
Page 889 is never used
Page 1897 is never used
Page 1899 is never used
Page 2320 is never used
Page 2332 is never used
Page 2348 is never used
Page 2552 is never used
Page 2564 is never used
Page 2565 is never used
rowid 104 missing from index GrcTestElementsUuidIdx
rowid 113 missing from index GrcTestElementsUuidIdx
rowid 141 missing from index GrcTestElementsUuidIdx
<snip>
rowid 56584 missing from index GrcTestElementsUuidIdx
rowid 56584 missing from index sqlite_autoindex_grc_test_elements_1
Error: database disk image is malformed

#####

[Expert@xxxxxx:0]# echo ".dump" | /usr/bin/sqlite3 BKP_grc_test_elements.sqlite | sed 's/ROLLBACK/COMMIT/g' | /usr/bin/sqlite3 FIXED_grc_test_elements.sqlite
[Expert@xxxxxx:0]# cp grc_test_elements.sqlite /home/admin
[Expert@xxxxxx:0]# cp FIXED_grc_test_elements.sqlite grc_test_elements
grc_test_elements.sqlite grc_test_elements.sqlite.tmp grc_test_elements_table.C
[Expert@xxxxxx:0]# cp FIXED_grc_test_elements.sqlite grc_test_elements.sqlite