index log files after moving logs from one log server to another log server

[checkmate-Go]

We recently replaced our open server hardware that was running the dedicated log server.  I moved only the .log files (not other log files) from /var/log/opt/CPsuite-R81.20/fw1/log/2024-11-*.log to /var/log/opt/CPsuite-R81.20/fw1/log/ on another server ranging from 2024-11-1 to 2024-11-19.

I’m wondering how indexing works after this transfer. Does it happen automatically, or do I need to manually re-index the logs? I only need the last 14 days of indexed logs.

It seems like the article I found is relevant, but I wanted to confirm: is moving just the .log files sufficient, or should I have moved the other log files as well?

https://support.checkpoint.com/results/sk/sk111766

[PhoneBoy]

While I believe the log files alone are sufficient, the other files have to be rebuilt if they are not transferred.
It's better to move them all.

And yes, you will have to manually reindex the logs after moving files into the directory.

[checkmate-Go]

what does "rebuilt if they are not transferred mean"?

I just copied all the .log files and followed instruction from this sk artice:

https://support.checkpoint.com/results/sk/sk111766

I am not sure if it indexed logs or not. How can I verify that? How long does it generally take to re-index logs?

[AkosBakos]

Don't forget, indexing the logs takes a while.

And don't forget evstop, and evstart. Ususallly thats why we don't apply this after upgrades. Is not worth the time.

Akos

[PhoneBoy · Accepted solution]

There are "pointer" files that are necessary for working with the logs (thus why the instructions state to copy $FWDIR/log/*.log* instead of $FWDIR/log/*.log.
I was mistaken that they are rebuilt automatically, you'd have to use fw repairlog (from the CLI) to do that.

As for whether the logs will get imported/indexed automatically, I would assume this would not be the case if you simply copied the files over.
Starting the reindexing process (as described in the SK) ensures this will be done.
The time will depend on the amount of logs, overall management/log server load, etc.
You will notice some increased CPU during this time, which will "back off" when other management processes need to use the CPU.
This is normal, expected behavior.