Security Gateway is logging locally and not sending logs to the Security Management Server

Support Center > Search Results > SecureKnowledge Details

Technical Level

Solution ID	sk152113
Technical Level
Product	Management Portal
Version	R80.10 (EOL)
OS	Gaia
Platform / Model	Open Server
Date Created	29-Apr-2019
Last Modified	16-Aug-2021

Symptoms

The user cannot see logs from the Security Gateway(s).
fwd reset does not work on the Security Gateway and Security Management Server.

FWD debug logs on the Security Gateway:

[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] ..-- > create_default_log
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] ...-- > connect_to_server
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] connect_to_server: server default
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] ....-- > connect_to_local_server
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] connect_to_local_server: 'default' as DEFAULT server
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] .....-- > set_new_server_status
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] .....< -- set_new_server_status
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] connect_to_local_server: connected to local server successfuly
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] ....< -- connect_to_local_server
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] ...< -- connect_to_server
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] create_default_log: connected to default log server
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] ...-- > log_local_write
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] ...< -- log_local_write
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] create_default_log: Buffer Overflow ! Save the cyclic buffer content locally. Start at 346595179, end at 346595179
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] ...-- > disconnect_from_server
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] ...-- > disconnect_from_server
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] ....-- > set_new_server_status
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] ....< -- set_new_server_status
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] disconnect_from_server: stop logging at 'default'
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] ...< -- disconnect_from_server
[FWD 9047 4014807488]@L00DC1EXTFW01[2 Apr 19:16:19] create_default_log: disconnected from default log server

Cause

fwd(/fw_full) is busy (100% CPU on the Security Management Server). As a result, it cannot collect logs from the Security Gateway.

Solution

Note: To view this solution you need to Sign In .