Unable to view historical Audit Logs after migration from R80.40 to R81.20

[drmusin]

After upgrading the Security Management Server (SMS) from R80.40 to R81.20, I proceeded with upgrading the Log Management Server (LMS) to the same version. The LMS upgrade was completed successfully, including the physical transfer of all audit log files (adtlog) to the new server.

All actions were performed in accordance with the official SK documents: sk107459 and sk111766. However, after the migration, issues arose when attempting to view historical logs via SmartConsole.

I require access to audit logs covering the past four years. When attempting to increase the log indexing retention period to accommodate this range, the system becomes unstable:

• The SOLR service crashes;

• LMS stops functioning properly — it no longer indexes log files and fails to display any logs in SmartConsole, including current ones;

• As a result, viewing both historical and recent logs becomes completely impossible.

Is there an alternative method to re-index old audit logs without increasing the indexing retention period globally? Any suggestions or best practices for handling long-term audit log access under R81.20 would be appreciated.

[PhoneBoy]

Not sure this is possible; I suggest working with your local Check Point office on a possible RFE.

In terms of out-of-the-box thinking, you might try copying just the audit logs to a new VM on a trial license and set the indexing for the required period: https://support.checkpoint.com/results/sk/sk107459 
Since no other logs will be indexed, perhaps solr will behave a bit better.

[the_rock]

I would open TAC case to see if they can help with this.

Andy

[garrod]

Refer to this and run reindexing.

https://support.checkpoint.com/results/sk/sk164553

[the_rock]

Not sure that may work for audit logs, but worth a try.

[Amir_Senn · Accepted solution]

SOLR version has been upgraded in R81 (and above) and logs do need re-indexing before you can view them.

You can view them by opening the log file manually:

You can also try to follow the following SK and change with extended log policy only the audit logs section:

https://support.checkpoint.com/results/sk/sk117317