0

The logging filled the disk of the managment node. This cause the firewall nodes to start logging locally. After deleting some old logs, restarting the managment node logging is still being done locally at the firewall nodes. I have already done a fw fetchlogs on all firewall nodes to get the local log entries.

How can I tell the firewall nodes that they should once again connect to the managment node?

My syslog_servers show doesn't show any syslog servers. But the documentation mentions that this is for additional logging and not for logging between firewall nodes and the managment node.

1
  • BTW, Check Point is two words.
    – pcapademic
    Jan 6, 2010 at 19:08

3 Answers 3

0

I am certain that the Check Point knowledgebase has this answer, although for the life of me I can't remember what to do. Two general things to try:

  1. Push policy to the firewall

  2. cpstop ; cpstart on the firewall

  3. Reboot the firewall (Windows and Check Point FW-1, both love the reboots)

.

2
  • Already did a install policies but it didn't solve it. Also did cpstart and cpstop on the managment, but it also didn't help. Are you suggesting cpstop and cpstart on the actual firewalls? Version is R70.
    – krugger
    Jan 6, 2010 at 19:13
  • In order to get the firewall module to try an initiate a logging connection after it has given up, I think you need to stop and start the mini-management process on the firewall. I thought policy push did so, but I could be wrong.
    – pcapademic
    Jan 7, 2010 at 5:07
0

Plain R70? We had an issue where the Management station wasn't getting incoming logs after a reboot.. Check Point support said it was a known issue with R70. (Sorry, I can't find an SK number for you). Updating to R70.30 on the management station fixed the problem.

0

You could give a try to fw logswitch on the firewall itself.
If it does not help, then a reboot might be needed, as previously suggested.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .