Debug & restart logs in quantum spark 1800

[asdfn]

Hello All,

Our environment uses a Quantum Spark 1800 as a security gateway that recently restarted unexpectedly during office hours. Though the downtime lasted only 3 minutes, we need to understand the cause to prevent future occurrences. Are debug or error logs available? Since we use SmartConsole to collect firewall logs, it would be helpful if there were a feature to send crash and reboot event logs to SmartConsole for monitoring and investigation.

Additionally, while reviewing logs and online resources, we discovered that the "OS112" best practice in the compliance blade enables administrators to record memory issues from Gaia when processes terminate abnormally. Could this help investigate the sudden restart issue? If so, where can we enable and review this best practice?

Many Thanks

[Chris_Atkinson]

If you're already running R81.10.15 please collect a Dr. Spark report and submit to TAC for further analysis.

Along with a CPinfo per: sk138892

[asdfn]

Thank you for your information. Since we purchased the product via a vendor, i might need to further request with them about opening a TAC. I will try to use Dr.Spark later.

Besides, are there any debug or error logs we can send from the appliance to SmartConsole? Also, we are curious about whether the BP OS112 in the compliance blade would be helpful in this scenario.

[Chris_Atkinson]

CPinfo & Dr. Spark should have the needed information then once the issue/symptom is understood better TAC will advise if a specific debug plan is required.

Beyond this you can investigate sending logs to a syslog server where needed but this typically isn't the SMS itself.

[G_W_Albrecht]

You have bought Support & Services with the box - if this is Direct Support, you could use the MAC of the SMB to get help using CP Chat in UC. With Collaborative Support, your vendor would have to contact your CCSP for your issue and hanlde the SR with CP TAC.

You can send System and Security Logs to your SMS: https://sc1.checkpoint.com/documents/SMB_R81.10.X/Help/Locally_Managed/EN/Content/Topics/Configuring...

As this is locally managed, you could also use Infinity Portal Spark Management (license is included!) to see the logs, events and much more: