Who rated this post

Were these commands run while the logs were being heavily delayed?  It doesn't look like it as this system has plenty of CPU/memory/disk speed. If they were it does not look like a resource issue to me and could be a Check Point code issue.  Keep in mind that the Log Indexer was significantly improved in R81 (or is it R81.10?) by getting rid of SOLR and using a much more efficient & scalable logging/indexing mechanism, and you are still on R80.40.

If you can identify when heavy log delays were occurring in the last 30 days, first determine the day of the month (i.e. 20th of August for this example).  Once you have that post the results of these commands run from expert mode:

sar -f /var/log/sa/sa20

sar -f /var/log/sa/sa20 -r

sar -f /var/log/sa/sa20 -n EDEV