Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Nick_Doropoulos
Advisor

$FWDIR/conf/log_policy.C

According to sk40090, the settings in the file above have to match the settings in SmartDashboard in the Security Management Server object.

My question is, what happens if they don't? Do we then have to edit the file ourselves by changing the respective boolean values followed by a cpstop ; cpstart?

Thanks in advance.

6 Replies
HeikoAnkenbrand
Champion Champion
Champion

You have already written several articles with logging. What is the exact problem?

If logging does not work properly. Please follow this SK40090.

➜ CCSM Elite, CCME, CCTE
Nick_Doropoulos
Advisor

There is no problem, I'm just trying to gain a deeper understanding if possible 😉

Would you happen to know the answer for the above question?
G_W_Albrecht
Legend
Legend

The GW takes the log config from $FWDIR/conf/log_policy.C. A policy install in Dashboard writes into $FWDIR/conf/log_policy.C upon changes in config.

CCSE CCTE CCSM SMB Specialist
Nick_Doropoulos
Advisor

I understand that but is it still possible for a discrepancy to exist so that we would need to modify the discussed file? Has anybody ever come across that scenario?

I'm asking because it is mentioned in the sk as one of the troubleshooting steps so I assume that it has happened.

Thanks.

Dror_Aharony
Employee Alumnus
Employee Alumnus

Hey Nic,

You shouldn't worry, no discrepancy exists unless you purposefully create it.

All CP servers (GW/Mgmt/Log-Server/SME, etc...) use & apply the log disk-space maintenance policy from/to this file:

$MDS_FWDIR/conf/log_policy.C

If you change it manually & run a restart to FWD process (cprestart), then your changes will now take hold temporarily, till an install database occurs, which will override your manual settings, so the GUI settings will again override the file & take hold.

but I must stress that there is no need to modify it manually aside from specific scenarios, like a Global SmartEvent server.

(see sk117317 | https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...)

 

 

Nick_Doropoulos
Advisor

That's great, thank you very much!

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events