No traffic logs at times

[Matlu]

Hello, everyone.

We have an issue with our SMS which is on version R81.10 (Open server)

"At times when we try to check the traffic logs, and we refresh the screen to see the logs, logs start appearing in the console that refer to "Mapping of data Center Finished".

This type of logs that appears, causes that the real logs that we need to review in moments of troubleshooting, simply "delay in appearing" in the console.

Has anyone "dealt" with this type of problem, and know how to correct it?

Regards

[the_rock]

I seen that once and reboot fixed it. Can you see if fw.log file on the fw is increasing? That would be sign of fw logging locally

watch -d ls -lh $FWDIR/log/fw.log

Andy

[Matlu]

Should this command be applied in the SMS?

Because this strange behavior is just in the SMS (when trying to view the logs).

It is "random", at times, the logs stop appearing, and this delays the troubleshooting.

Do you recommend to restart the SMS and/or GW?

Because the SMS has hooked a couple of GW clusters.

Greetings.

[the_rock]

Just reboot sms.

[the_rock]

2 best sk's to check.

Andy

https://support.checkpoint.com/results/sk/sk38848

https://support.checkpoint.com/results/sk/sk40090

[Daniel_3]

There was a similar question for this topic once - maybe this helps:

https://community.checkpoint.com/t5/General-Topics/r81-manager-logging/td-p/128649 

[the_rock]

I think @Matlu would need to clarify 100% if firewall might be logging locally first. Its not really clear from the description, but that reference post is good.

Cheers,

Andy

[Matlu]

I didn't understand the comment "Do you log into the Firewall first?"

What I can give as a detail, is that these uncomfortable logs, appear when we log in to the SMS that has "hooked" a couple of GW Clusters.

When we try to check the logs, from one moment to another these messages appear, and then the real logs, take time to appear, and that delays the tasks of reviewing any particular traffic.

I had already read that forum that you shared, but I can't find what was the "solution" that you applied at the time.

We don't want those messages to appear.
Is there a way to avoid that?

We are not using updatable objects.

Regards.

[the_rock]

Bro, just reboot the mgmt server, thats easiest way to solve this.

Andy