Log Retention Limitation on Check Point 2000 Cluster (Locally Managed)

[rozkie20]

Hi Everyone,

We are currently using a Check Point Cluster 2000 appliance in locally managed mode. Recently, we have observed that the system is only retaining approximately 22,000 logs, which is significantly lower than expected.

Previously, we were able to store up to 20 million logs without any issue. We're unsure why the log retention capacity has suddenly decreased.

Has anyone experienced a similar issue? Any insights or suggestions would be greatly appreciated.

Thank you in advance.

[G_W_Albrecht]

Did you perform any changes, e.g. firmware update ? How is this configured:

[rozkie20]

Hi Albrecht,

in the last, we upgraded to 81.10.17. 

I also try with configure Litmit the number of logs to search to 20 milliions but it still limit by 22000 and nothing change. with peer member in the cluster we change to 20 millions and we see it have 19 millions logs and this gateway is limited. I do not know the reason why?

[G_W_Albrecht]

So the limitation appeared after upgrade to 81.10.17. ? Did you try to revert to the former version ?

What if you uncheck the Limit the number.. setting ? Then it should be unlimited...

With same firmware version on both nodes all should be OK. I just wonder why you differentiate between active and standby member - usually, you only connect to the VIP (that is the active node) and only do configuration changes there, as the standby will sync it automatically.

I would suggest to contact CP TAC to get behind this!

[Chris_Atkinson]

Please raise the issue with TAC for investigation, if there is a limit imposed for 1500 series devices for instance it shouldn't apply to 2000 series devices with additional storage for mind. 

[ohadp]

Did you check Extended Monitoring via the Infinity Portal?
It’s much better, with many more capabilities.

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Content/Topics/Exte...

https://www.youtube.com/watch?v=q-7YxwIBMXo 

[Chris_Atkinson]

Is this unit R81.10.17 firmware and did someone install an SD card or stop local logging by chance?

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Content/Topics/View...

[rozkie20]

Exactly, we using firmware version R81.10.17, which was recommended by TAC.

So we have not made any recent configuration changes, but we’ve noticed that the system is now limiting log retention to approximately 22,000 entries. Older logs appear to be automatically deleted, even though we previously observed the system storing up to 20 million logs