Support Center > Search Results > SecureKnowledge Details
SmartView Tracker shows duplicate logs when SecureXL is enabled in the cluster Technical Level
Symptoms
  • SmartView Tracker shows duplicate logs with the same details from the cluster.

  • Kernel debug ('fw ctl debug -m fw + log') on cluster members shows that the same log is issued twice for a connection.

    Example:
    ;27May2015 13:11:17.401223;[cpu_11];[fw4_22];fwchainlog_generate_conn_log_from_conn_key_ex: send log <dir 1, 172.30.101.240:60424 -> 192.168.137.51:443 IPP 6>;
    ;27May2015 13:11:18.401243;[cpu_11];[fw4_22];fwchainlog_generate_conn_log_from_conn_key_ex: send log <dir 1, 172.30.101.240:60424 -> 192.168.137.51:443 IPP 6>;
  • Disabling SecureXL on all cluster members resolves the issue.

Cause

Log is incorrectly issued twice for these TCP connections:

  1. TCP connections are matched to SecureXL NAT Templates.
  2. Delayed Notification is configured for these TCP connections (Service properties - click on "Advanced..." button - check the box "Start synchronizing [] seconds after connection initiation"; For more details about this setting, refer to SmartDashboard built-in Help in this window).

Solution
Note: To view this solution you need to Sign In .