Here are a few suggestions: 1. See sk30530 - SmartCenter Server not receiving logs from Security Gateway, after migrating to distributed configuration. * Make sure to convert your SmartCenter to a *host* and *delete all interfaces* in Topology Tab and re-install policy. 2. See sk26214 - Firewall not sending logs to SmartCenter Server, is storing logs locally. 3. Try to install database on your SmartCentrer and re-open SmartView Tracker.
Keep us posted if any of these suggestions solved your problem. Thanks, Adam. Mark Senior <[EMAIL PROTECTED]> wrote: Hello list I've got a peculiar situation here: I've built a SPLAT R55 cluster (two modules, HA new mode), and a Windows 2003 R55 management server. For some reason, the firewall logs aren't being received by the management server. >From a network perspective, everything seems to be able to communicate fine. I can ping both directions between cluster members and management server, install policies on the cluster, SSH to the cluster from the management server, and so on. As you can see from the output below, the modules are able to make connections on TCP port 257 (FW1_log) to the management cluster, and they're sending _something_ over the wire on those connections (not much, as the ACK numbers don't seem to go above about 70) Also, I'm unable to fetch the logs off the remote machines within smartview tracker (tools > remote files management > pick a module, get file list > pick a log file, fetch files). The result is that the fetch failed, with 0% progress. However, I can fetch the logs successfully by commandline with fw lslogs / fw fetchlogs. Thanks in advance for your help Mark Some diagnostic output, which shows that: (1) the module is generating, and at least attempting to send, logging data: [EMAIL PROTECTED] fw log -ft Date: Mar 20, 2006 11:31:35 accept module-2 cluster; s_port: 32900; dst: management; service: FW1_log; proto: tcp; rule: 0; message_info: Implied rule; 11:31:50 accept module-2 cluster; s_port: 32901; dst: management; service: FW1_log; proto: tcp; rule: 0; message_info: Implied rule; (2) the module is sending actual data on those logging connections, and the management server is acknowledging its receipt, at layer three if not higher: [EMAIL PROTECTED] tcpdump -i eth2 -s 0 "port 257" tcpdump: listening on eth2 11:28:32.715848 module-2.32888 > management.257: S 2425846703:2425846703(0) win 5840 (DF) 11:28:32.716150 management.257 > module-2.32888: S 2256300641:2256300641(0) ack 2425846704 win 16384 0,nop,nop,sackOK> 11:28:32.716190 module-2.32888 > management.257: . ack 1 win 5840 (DF) 11:28:32.716251 module-2.32888 > management.257: P 1:5(4) ack 1 win 5840 (DF) 11:28:32.716806 management.257 > module-2.32888: P 1:5(4) ack 5 win 65531 (DF) 11:28:32.716837 module-2.32888 > management.257: P 5:9(4) ack 5 win 5840 (DF) 11:28:32.868495 management.257 > module-2.32888: . ack 9 win 65527 (DF) 11:28:32.868515 module-2.32888 > management.257: P 9:69(60) ack 5 win 5840 (DF) 11:28:32.869060 management.257 > module-2.32888: P 5:59(54) ack 69 win 65467 (DF) 11:28:32.905408 module-2.32888 > management.257: . ack 59 win 5840 (DF) 11:28:32.905634 management.257 > module-2.32888: P 59:72(13) ack 69 win 65467 (DF) 11:28:32.905652 module-2.32888 > management.257: . ack 72 win 5840 (DF) 11:28:32.906653 module-2.32888 > management.257: F 69:69(0) ack 72 win 5840 (DF) 11:28:32.906854 management.257 > module-2.32888: . ack 70 win 65467 (DF) 11:28:32.906970 management.257 > module-2.32888: F 72:72(0) ack 70 win 65467 (DF) 11:28:32.906989 module-2.32888 > management.257: . ack 73 win 5840 (DF) 11:28:47.915845 module-2.32889 > management.257: S 2443795765:2443795765(0) win 5840 (DF) 11:28:47.916162 management.257 > module-2.32889: S 647665702:647665702(0) ack 2443795766 win 16384 0,nop,nop,sackOK> 11:28:47.916204 module-2.32889 > management.257: . ack 1 win 5840 (DF) 11:28:47.916267 module-2.32889 > management.257: P 1:5(4) ack 1 win 5840 (DF) 11:28:47.917000 management.257 > module-2.32889: P 1:5(4) ack 5 win 65531 (DF) 11:28:47.917014 module-2.32889 > management.257: P 5:9(4) ack 5 win 5840 (DF) 11:28:48.071400 management.257 > module-2.32889: . ack 9 win 65527 (DF) 11:28:48.071420 module-2.32889 > management.257: P 9:69(60) ack 5 win 5840 (DF) 11:28:48.071966 management.257 > module-2.32889: P 5:59(54) ack 69 win 65467 (DF) 11:28:48.105407 module-2.32889 > management.257: . ack 59 win 5840 (DF) 11:28:48.105668 management.257 > module-2.32889: P 59:72(13) ack 69 win 65467 (DF) 11:28:48.105685 module-2.32889 > management.257: . ack 72 win 5840 (DF) 11:28:48.106663 module-2.32889 > management.257: F 69:69(0) ack 72 win 5840 (DF) 11:28:48.106878 management.257 > module-2.32889: . ack 70 win 65467 (DF) 11:28:48.107070 management.257 > module-2.32889: F 72:72(0) ack 70 win 65467 (DF) 11:28:48.107087 module-2.32889 > management.257: . ack 73 win 5840 (DF) This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= --------------------------------- Blab-away for as little as 1ยข/min. Make PC-to-Phone Calls using Yahoo! Messenger with Voice. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
