show logs API timeout reached

[srinidhi]

Hi All,

I am trying to collect logs using API, but when i run the command show-logs, I am not getting any response for long time, and the timeout error occurs. I have tried in management cli, gaia cli and web service http request. But in all the methods I get the timeout error.

these are the commands I am trying

mgmt show-logs new-query.top.count "10"

curl  -XPOST "https://x.x.x.x:443/web_api/show_logs" --data-binary "{\"new-query\": {\"time-frame\": \"last-7-days\", \"max-logs-per-request\" : \"2\"}}" -H "Content-Type: application/json" -H "X-chkp-sid: xxxxxx"

I could not see the logs in the smart console even as it fails to connect to the server. but my management server is up and running.

can anyone please let me know how to get the logs using API and in the smart console.

[Chris_Atkinson]

Is this a standalone deployment, what setup steps were performed?

Which version is this and what is the output of 'api status' command?

[srinidhi]

• Yes, This is a Standalone deployment done with ISO image in Network Emulator (EVE-NG)

  Version - Checkpoint R81.10 T335

  Both Security Management and Gateway Installed. 

• api status output is successful

[Chris_Atkinson]

Have you applied any Jumbo hotfix to the environment?

[srinidhi]

No, I havent done any

[Chris_Atkinson]

Patch it and make sure it has enough resources assigned and let us know how you go from there.

[srinidhi]

I have assigned 12GB RAM and 80GB storage space to the VM, Please let me know if I need to still increase the memory to access the logs through api and smart console.

[Chris_Atkinson]

Did you apply JHF T78 yet?

[srinidhi]

I have installed the Jumbo Hotfix T78 

But still I see the issue persisting 

[PhoneBoy]

When I see issues like this, the answer is usually allocate more memory to the VM.
For a small standalone deployment, 8GB is the absolute minimum if SmartEvent isn't used.
With SmartEvent, 16GB is probably more appropriate.

[Tomer_Noy]

Another option that might work well for you, if you want to keep the gateway image small, is to manage it from Smart-1 Cloud.

You can opt for a tenant with a license for just 1 gateway. There are many benefits to separating the management from the gateway instance, and Smart-1 Cloud is an easy option that doesn't make you install another machine or VM.

[srinidhi]

Thanks, can you please let me know where can I check the current memory allocation which you are referring to. 

also I tried to increase the RAM allocation from 8GB to 12GB, but still I can see the smart console fails to connect to the server. I have attached the image for the same. Please let me know where I should be checking for the memory allocations.

[srinidhi]

I am able to run the log exporter and get the logs but I am not able to access the show logs api using mgmt_cli or API commands, as it gets timed out.  where I can access the other API commands, but only 'show_logs' API is getting timed out.

Please let me know if this is due to Smart event and the configuration.

my current memory configuration is 

RAM - 12gb, storage - 80gb, CPU - 2

Here I can see the smartlog server running.

Also I am using the trial license, Please let me know if this license is enough for accessing the logs using the API.

Thanks!

[Tomer_Noy]

If you cannot see logs in SmartConsole, then it's not an API issue.

Either the machine is severely overloaded (top output might help to see that), or something in the logging configuration is misconfigured.

[srinidhi]

I see that there is no issue with the API as I can access other APIs like login, publish or discard. 
But I see only 'show logs' API getting timed out. I have tried to query with top 10 records and still getting the same time out error.

Also I can see that the CPU usage is only around 20% 

Can you please help me with the proper logging configuration and any other cause for this issue

[srinidhi]

If are unable to see logs in Smart Console,

Will it affect the log viewing through API also ?

As we are getting the same error while trying to view logs through Smart Console and API

[Chris_Atkinson]

Is there a reason that you are ignoring the SmartConsole update notification?

[srinidhi]

can you let me know if this 16GB is the RAM in VM, and if yes, is it mandatory for 16GB RAM to collect logs using API.

[PhoneBoy]

16GB is what I recommend generally for performance reasons.
12GB may be fine in a small lab environment.

From your other thread, I see two potential issues: https://community.checkpoint.com/t5/Management/Unable-to-view-logs-in-Smart-Console-for-Version-R81-...

• The RAM that was allocated when First Time Wizard was run (12GB should be ok)
• 80GB allocated to VM HDD, which might cause this problem: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

The minimum hardware requirements are listed in the release notes: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RN/Topics-RN/Hardware-Requir... 

Having said that, I find decent success (in the lab) with 16GB RAM, 4 Cores, and at least 200GB allocated (again, small lab environment).
You might be able to get away with less, but I'd start there.