fwm logexporter fails - file to large

[WesEvernden]

Hi,

I am trying to take a large log file from our busy DMZ and export it using a eval install running in hyper-v on my laptop.

I can do fwm logexport of the running fw.log fine but when I try it with the DMZ file I get File is too large. The DMZ log file is 2,328,043,520 bytes. 

This is R80.30, 64bit, 8GB mem. I can cat the file. Any ideas appreciated. Thanks.

[Expert@gw-460f06:0]# fwm logexport -n -p -i test.log

 pfopen: failed to open /opt/CPsuite-R80.30/fw1/log/test.log

 CBinaryFile::Open: failed to open file (/opt/CPsuite-R80.30/fw1/log/test.log) for reading

 CBinaryFile::Open: exit status false

 CMappedBinaryFile::error opening file /opt/CPsuite-R80.30/fw1/log/test.log

 CLogFile::Open2: error: open (/opt/CPsuite-R80.30/fw1/log/test.log) for reading failed

 Failed to open file '/opt/CPsuite-R80.30/fw1/log/test.log': File too large

 log_initfile: error - unable to open and read file: test.log

Error: Failed to open log file

[Expert@gw-460f06:0]# ls -l test.log
-rw-rw-r-- 1 admin root 2328043520 Feb 18 13:12 test.log

[PhoneBoy]

I suspect fwm logexport has not been updated to support files larger than 2GB, a limit that has been around for quite some time.
In fact, I'm a little surprised you were able to create a single log file larger than 2GB since the limit is related to the filesystem.
That said, I guess xfs allows creation of larger files.

In any case, you can work around this as follows: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[WesEvernden]

Thanks. I saw that article but it doesn't work for me. My problem seems to be related to reading the file.

[Expert@gw-460f06:0]# fwm logexport -n -p -i test.log -x 0 -y 100 > /var/log/LogExportTest.txt
pfopen: failed to open /opt/CPsuite-R80.30/fw1/log/test.log
CBinaryFile::Open: failed to open file (/opt/CPsuite-R80.30/fw1/log/test.log) for reading
CBinaryFile::Open: exit status false
CMappedBinaryFile::error opening file /opt/CPsuite-R80.30/fw1/log/test.log
CLogFile::Open2: error: open (/opt/CPsuite-R80.30/fw1/log/test.log) for reading failed
Failed to open file '/opt/CPsuite-R80.30/fw1/log/test.log': File too large
log_initfile: error - unable to open and read file: test.log
Error: Failed to open log file

[PhoneBoy]

Believe a TAC case will be necessary to resolve this.

[Dror_Aharony]

Hi Wes,

You have 2 other options.

1. for using/backupping the log-file, simply copy it .log* to any other CP-server.

2. for printing logs into .txt file, you can use the CPLogFilePrint, instead. it's newer & better.

    CPLogFilePrint <log-file_path> > text-file.

    CPLogFilePrint $FWDIR/log/fw.log > text-file.