Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The logging filled the disk of the managment node. This cause the firewall nodes to start logging locally. After deleting some old logs, restarting the managment node logging is still being done locally at the firewall nodes. I have already done a fw fetchlogs on all firewall nodes to get the local log entries.

How can I tell the firewall nodes that they should once again connect to the managment node?

My syslog_servers show doesn't show any syslog servers. But the documentation mentions that this is for additional logging and not for logging between firewall nodes and the managment node.

share|improve this question
    
BTW, Check Point is two words. –  pcapademic Jan 6 '10 at 19:08
add comment

2 Answers

I am certain that the Check Point knowledgebase has this answer, although for the life of me I can't remember what to do. Two general things to try:

  1. Push policy to the firewall

  2. cpstop ; cpstart on the firewall

  3. Reboot the firewall (Windows and Check Point FW-1, both love the reboots)

.

share|improve this answer
    
Already did a install policies but it didn't solve it. Also did cpstart and cpstop on the managment, but it also didn't help. Are you suggesting cpstop and cpstart on the actual firewalls? Version is R70. –  krugger Jan 6 '10 at 19:13
    
In order to get the firewall module to try an initiate a logging connection after it has given up, I think you need to stop and start the mini-management process on the firewall. I thought policy push did so, but I could be wrong. –  pcapademic Jan 7 '10 at 5:07
add comment

Plain R70? We had an issue where the Management station wasn't getting incoming logs after a reboot.. Check Point support said it was a known issue with R70. (Sorry, I can't find an SK number for you). Updating to R70.30 on the management station fixed the problem.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.