Log server <name> went down.

[quarknetworks]

I am having a problem with R65 SPLAT box logging. We have three checkpoint HA clusters shipping logs off to this "management station".

I’ve tried restarting the cp services(cpstop/cpstart) , and rebooting the box to no avail. Logs are no longer writing. It looks like the syslog service has died, but I can’t figure out how to restart or fix it. Any help would be greatly appreciated.

Number: 13206572
Date: 13Oct2008
Time: 12:49:52
Interface: daemon
Origin: us-co-englwd-mgr1
Type: Control
Action:
Information: sys_message: started logging swiss-nuchtl-hafw1
Product: VPN-1 Power/UTM


Number: 13206573
Date: 13Oct2008
Time: 12:44:27
Interface: daemon
Origin: swiss-nuchtl-hafw1
Type: Control
Action:
Information: sys_message: log server 10.1.102.247 went down
Product: VPN-1 Power/UTM

Number: 13206574
Date: 13Oct2008
Time: 12:49:54
Interface: daemon
Origin: us-co-englwd-mgr1
Type: Alert
Action:
Information: FWD Error: failed to write log from 10.41.0.102.
Product: VPN-1 Power/UTM

[cciesec2006]

service syslog restart

[Thorpuse]

no free disk on that partition?

[northlandboy]

You might want to get NTP sorted out while you're at it...

[quarknetworks]

Originally Posted by Thorpuse

no free disk on that partition?

Should be 54% free.

[Expert@us-co-englwd-mgr1]# df -k
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/cciss/c0d0p7 1032056 186736 792896 20% /
none 1032056 186736 792896 20% /dev/pts
/dev/cciss/c0d0p1 150128 9975 132402 8% /boot
/dev/cciss/c0d0p2 3562112 1291480 2089684 39% /opt
none 1026848 0 1026848 0% /dev/shm
/dev/cciss/c0d0p6 1546064 593852 873676 41% /sysimg
/dev/cciss/c0d0p5 130667676 56917704 67112428 46% /var
[Expert@us-co-englwd-mgr1]#

[quarknetworks]

Originally Posted by cciesec2006

service syslog restart

Command worked, but problem persists on the Smartview Tracker.

[Expert@us-co-englwd-mgr1]# service syslog restart
Shutting down kernel logger: [ OK ]
Shutting down system logger: [ OK ]
Starting system logger: [ OK ]
Starting kernel logger: [ OK ]
[Expert@us-co-englwd-mgr1]#

[quarknetworks]

Originally Posted by northlandboy

You might want to get NTP sorted out while you're at it...

Fixed NTP. :-)

[msjouw]

Check the $FWDIR/log/fwd.elg to see if there are any more messages there that are more directive to what is going on?
You could try to run a fw logswitch on the Smartcenter to start with.