VSX logs lag behind on SmartConsole

[chinchira]

Hello CheckMates,

I have a VSX deployment with multiple VSes. Management server and log server are different. All running R80.40 JHF 118.

When searching for current logs on Smartconsole, there is one particular VS1 whose logs keeping lagging behind. The lag could be a few minutes to several hours depending on time of day, but most of the time it is hours. There is another VS2 which generates twice as much logs as VS1 but the logs are upto date on Smartconsole, zero lag. 

When logging services are restarted on log server(evstop;evstart), one is able to view current logs but the lag starts building up immediately. 

Am here to see if anyone has come across the same issue and what was the solution if any. Any pointers in the right direction is much appreciated.

Thanks,

[Timothy_Hall]

If you bring up the old-school SmartView Tracker while the VS1 logs are severely lagged, are the VS1 logs showing up in a timely fashion there but not in the SmartConsole?  If yes it is a log indexing issue.  If they are lagged in the SmartView Tracker as well it is probably a log transport issue between the VS1 gateway and the SMS on TCP/257.

[PhoneBoy]

You should be able to open a specific log file even in SmartView as well (in the Hamburger menu).
The current log file is always fw.log.

[chinchira]

Yes, they are also lagged on SmartView. The connection on TCP/257 is okay, but I will try and see if there is any issue along the path between the two.

[PhoneBoy]

This might be a good reason to upgrade your management to R81.10 as the log indexing performance and capacity has improved in that release.

[chinchira]

Thanks for the suggestion, but I think that will be our very last resort once we have run out of options. Am thinking there is some other underlying issue that needs to be identified first.

[SamiH]

We have had the same problem since upgrading to r80.40. Now it is take 139. When we boot the mgmt/logging server, it starts indexing logs with all the cpu there is. The delay is often 1 h or near that, it doesn't stop indexing altogether.

Haven't had time to do a ticket since we have had several tickets with Check Point during the last year about different matters and it always takes a lot of time to inspect and proof the matter and we do have other things to do also.