log_indexer unable to index all the files

[Blason_R]

Hi Team,

we are on R80.20 Smart 1 appliance and previously due to the memory crunch Smart log wasn't activated. However recently we upgraded to 16GB of RAM and enable the log_indexing; installed the database. The process has successfully started and able to start indexing however we could see it was able to index only last 2 days of files in 14 hrs. 

I checked the logs and this is currently indexing existing files/logs however it not picking up the earlier logs. The process is alive and the same can be spotted from cpwd_admin list.

Any hint would be appreciated.

[Wolfgang]

@Blason_R 

see R80.x SmartLog/SmartEvent server doesn't index/show logs older than 1-14 days back 

to enable the indexer to process your older logs.

Wolfgang

[Blason_R]

yes - was aware of that let me try that option.

Thanks for pointing it out.

[Blason_R · Accepted solution]

By the way according to the sk I need to run log_indexer command, but unsure the exact flags needs to run.

has anyone have any experience with the flag or if someone can confirm below command is correct?

./log_indexer -days_to_index <NUM_OF_DAYS_TO_INDEX>

i.e.

./log_indexer -days_to_index 30 

[JakubSykora]

Hi, yes command is correct. See Support, Support Requests, Training, Documentation, and Knowledge base for Check Point products and ...