Log report script

[the_rock]

Hey guys,

This script gives basic info as far as logging rate and any known issues.

Lab example:

[Expert@CP-GW:0]# cd /var/log/scripts/
[Expert@CP-GW:0]# dos2unix *
dos2unix: converting file cp_log_health_report.sh to Unix format ...
[Expert@CP-GW:0]# chmod 777 *
[Expert@CP-GW:0]# ./cp_log_health_report.sh

===== Check Point Logging Health Report =====
Host : CP-GW
Timestamp : 2026-02-20_074729
Requested role : auto
Mgmt IP (optional) : (not set)
Mgmt Name (optional) : (not set)
Disk warning threshold : 85%
fw.log growth window : 5s
Detected FWDIR : /opt/CPsuite-R82/fw1
Effective role : gw

===== Version / Environment =====

$ fw ver
This is Check Point's software version R82 - Build 017

$ uname -a
Linux CP-GW 4.18.0-372.9.1cpx86_64 #1 SMP Mon Feb 2 13:41:14 IST 2026 x86_64 x86_64 x86_64 GNU/Linux

===== Process health (WatchDog) =====

$ cpwd_admin list
APP PID STAT #START START_TIME MON COMMAND
FWK_FORKER 12793 E 1 [07:52:19] 17/2/2026 N fwk_forker
FWK_WD 12802 E 1 [07:52:19] 17/2/2026 N fwk_wd -i 6 -i6 0
CPVIEWD 13424 E 1 [07:52:24] 17/2/2026 N cpviewd
CVIEWAPIS 13453 E 1 [07:52:24] 17/2/2026 N cpview_api_service
CPVIEWS 13460 E 1 [07:52:24] 17/2/2026 N cpview_services
SXL_STATD 13473 E 1 [07:52:24] 17/2/2026 N sxl_statd
MSGD 13504 E 1 [07:52:25] 17/2/2026 Y msgd
CPD 13588 E 1 [07:52:25] 17/2/2026 Y cpd
MPDAEMON 13608 E 1 [07:52:25] 17/2/2026 N mpdaemon /opt/CPshrd-R82/log/mpdaemon.elg /opt/CPshrd-R82/conf/mpdaemon.conf
TP_CONF_SERVICE 13646 E 1 [07:52:25] 17/2/2026 N tp_conf_service --conf=tp_conf.json --log=info
CI_CLEANUP 13785 E 1 [07:52:27] 17/2/2026 N avi_del_tmp_files
CIHS 13790 E 1 [07:52:27] 17/2/2026 N ci_http_server -j -f /opt/CPsuite-R82/fw1/conf/cihs.conf
FWD 13859 E 1 [07:52:27] 17/2/2026 N fwd
SPIKE_DETECTIVE 13887 E 1 [07:52:27] 17/2/2026 N spike_detective
RAD 14729 E 1 [07:52:33] 17/2/2026 N rad
LPD 15312 E 1 [07:52:38] 17/2/2026 N lpd
WSDNSD 17220 E 1 [07:53:36] 17/2/2026 Y wsdnsd
DLPU_0 17231 E 1 [07:53:36] 17/2/2026 Y dlpu -i4 0 1 -i6 -1 -1
DLPU_1 17234 E 1 [07:53:36] 17/2/2026 Y dlpu -i4 2 3 -i6 -1 -1
DLPU_2 17237 E 1 [07:53:36] 17/2/2026 Y dlpu -i4 4 5 -i6 -1 -1
TOPOD 17999 E 1 [07:53:43] 17/2/2026 Y topod
UPRD 18009 E 1 [07:53:43] 17/2/2026 Y uprd
MFDEMUXER 18143 E 1 [07:53:43] 17/2/2026 N /opt/CPcvpn-R82/bin/MoveFileDemuxer /opt/CPcvpn-R82/log/MFDemux.log /opt/CPcvpn-R82/conf/mfdemuxer.C
DBWRITER 18146 E 1 [07:53:43] 17/2/2026 N dbwriter /opt/CPcvpn-R82/log/dbwriter.elg /opt/CPcvpn-R82/conf/dbwriter.C
CVPNPROC 18149 E 1 [07:53:43] 17/2/2026 N cvpnproc /opt/CPcvpn-R82/log/cvpnproc.elg /opt/CPcvpn-R82/conf/cvpnproc.C
MFSERVER 18153 E 1 [07:53:43] 17/2/2026 N /opt/CPcvpn-R82/bin/MoveFileServer /opt/CPcvpn-R82/log/MFServer.log /opt/CPcvpn-R82/conf/mfserver.C
CVPNUMD 18161 E 1 [07:53:43] 17/2/2026 N /opt/CPcvpn-R82/bin/CvpnUMD
PINGER 18164 E 1 [07:53:43] 17/2/2026 N /opt/CPcvpn-R82/bin/Pinger /opt/CPcvpn-R82/log/Pinger.log /opt/CPcvpn-R82/conf/Pinger.C
IDLEPINGER 18167 E 1 [07:53:43] 17/2/2026 N /opt/CPcvpn-R82/bin/IdlePinger /opt/CPcvpn-R82/log/IdlePinger.log /opt/CPcvpn-R82/conf/IdlePinger.C
CVPNANALYTICS 18170 E 1 [07:53:43] 17/2/2026 N /opt/CPcvpn-R82/bin/CvpnAnalytics
CVPND 18178 E 1 [07:53:44] 17/2/2026 N cvpnd /opt/CPcvpn-R82/log/cvpnd.elg /opt/CPcvpn-R82/conf/cvpnd.C
GUACDISPATCHER 18320 E 1 [07:53:45] 17/2/2026 N /opt/CPcvpn-R82/bin/GuacDispatcher /opt/CPcvpn-R82/log/GuacDispatcher.log /opt/CPcvpn-R82/conf/GuacDispatcher.C
RTMD 26035 E 1 [07:55:31] 17/2/2026 N rtmd
DASERVICE 26102 E 1 [07:55:32] 17/2/2026 N DAService_script
AUTOUPDATER 26115 E 1 [07:55:32] 17/2/2026 N AutoUpdaterService.sh
PROBEMOND 26133 E 1 [07:55:32] 17/2/2026 N probemond
[FAIL] Process FWD is NOT Executing (E) or not present
[FAIL] Process CPD is NOT Executing (E) or not present
[FAIL] Process FWM is NOT Executing (E) or not present

===== Disk space checks (logging can stop when disk is low) =====

$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current 50G 13G 38G 26% /
/dev/sda2 283M 39M 230M 15% /boot
/dev/mapper/vg_splat-lv_log 50G 9.2G 41G 19% /var/log
tmpfs 7.6G 36M 7.5G 1% /dev/shm
tmpfs 7.6G 0 7.6G 0% /dev/shm_huge
cgroup 7.6G 0 7.6G 0% /sys/fs/cgroup

$ df -h '/opt/CPsuite-R82/fw1/log'
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_log 50G 9.2G 41G 19% /var/log
[OK] Disk usage for / is 26%
[OK] Disk usage for /opt/CPsuite-R82/fw1/log is 19%

===== Gateway checks =====

$ cp_conf sic state

Trust State: Trust established

===== masters file (/opt/CPsuite-R82/fw1/conf/masters) =====

$ sed -n '1,120p' '/opt/CPsuite-R82/fw1/conf/masters'
[Policy]
CP-MANAGEMENT
[Log]
CP-MANAGEMENT
[Alert]
CP-MANAGEMENT

===== fw.log growth test (5s window) =====

$ ls -l '/opt/CPsuite-R82/fw1/log/fw.log'
-rw-rw---- 1 admin root 8384 Feb 20 00:00 /opt/CPsuite-R82/fw1/log/fw.log
[OK] fw.log did not grow in the sample window
[INFO] Mgmt IP not supplied; skipping active TCP/257 connection test

===== Recent FWD log errors (tail + pattern scan) =====

$ tail -n 200 '/opt/CPsuite-R82/fw1/log/fwd.elg' | egrep -i 'revoked|certificate|handshake|ssl|connect|refused|timeout|timed out|no route|failed|error' | tail -n 40 || true
CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log) for reading failed
log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log
CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//tracker.log
CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//tracker.log
CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//tracker.log) for reading failed
log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//tracker.log
CBinaryFile::ReadHeader: failed to read header
CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log
CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log
CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log) for reading failed
log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log
pnp_get_blade_data_imp: Failed to get expiration of blade PNP_BLADE_ABOT
CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//tracker.log
CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//tracker.log
CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//tracker.log) for reading failed
log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//tracker.log
CBinaryFile::ReadHeader: failed to read header
CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log
CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log
CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log) for reading failed
log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log
CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//tracker.log
CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//tracker.log
CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//tracker.log) for reading failed
log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//tracker.log
CBinaryFile::ReadHeader: failed to read header
CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log
CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log
CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log) for reading failed
log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log
pnp_get_blade_data_imp: Failed to get expiration of blade PNP_BLADE_ABOT
CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//tracker.log
CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//tracker.log
CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//tracker.log) for reading failed
log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//tracker.log
CBinaryFile::ReadHeader: failed to read header
CBinaryFile::Open: failed to read header for /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log
CMappedBinaryFile::error opening file /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log
CLogFile::Open2: error: open (/opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log) for reading failed
log_initfile: error - unable to open and read file: /opt/CPsuite-R82/fw1/log//fwaccel_dos_rate_last_install.log

===== Log connection status (cpstat) =====

$ cpstat fw -f log_connection || true

Overall Status: 0
Overall Status Description: Security Gateway is reporting logs as defined
Local Logging Mode Description: Logs are written to log server
Local Logging Mode Status: 0
Local Logging Sending Rate: 0
Log Handling Rate: 4

Log Servers Connections
--------------------------------------------------------
|IP |Status|Status Description |Sending Rate|
--------------------------------------------------------
|172.16.10.252| 0|Log-Server Connected| 4|
--------------------------------------------------------

===== Summary / Next steps hints =====
If you saw FAIL/WARN above, common fixes per Check Point guidance include:
- Verify disk space on Mgmt/Log Server (df -kh), and adjust log retention if needed.
- Ensure Mgmt/Log Server is listening on TCP/257 and the path is reachable end-to-end.
- Verify the gateway's 'Logs' settings in SmartConsole and run 'Install Database' if needed.
- Confirm SIC trust status and fix/reset SIC if broken.
- Confirm /opt/CPsuite-R82/fw1/conf/masters has the correct [Log] server.
- If fw.log is corrupted, Check Point suggests moving fw.log* aside and restarting services (cpstop/cpstart).

Report saved to : /var/log/cp_log_health_CP-GW_2026-02-20_074729.txt
[Expert@CP-GW:0]#