What Check Point calls the "active log file" is not really a single file, but several of them that work together. If you check the logs folder, you will find groups of files that contain a date on their file names, those with the same date are the "log file" closed during a log switch on the date indicated, but you will also find several other files that do not have any dates on the file names, those are the "active log file" and you should never touch them or bad things will happen to your logging...
I'm thinking may be you moved one of those files and if that was the case, stopping services, moving the file back in place and starting services again, should get the issue resolved. Now, if you are just unable to figure out what did you remove, or if you deleted something and so are now unable to put it back, do cpstop, create a backup directory somewhere else (/var for example) and copy the entire contents of $FWDIR/log to that folder, then erase everything on the original "log" folder, so the folder is empty. Finaly do cpstart and as the services come back up a new "log file" and all corresponding parts of it will be generated once again and you should have a working log again. If something goes wrong or you still have problems, at least you have everything backed up. Hope this helps. Regard On 6/22/07, Robert Filipovich <[EMAIL PROTECTED]> wrote:
Has anyone had a problem with logging getting corrupt or stop working? Running NG R55 on splat and was cleaning the log directory to clear space and then it starting logging weird. Its something I had done before without this result. FW Logswitch does not work either so it's the same log but its only growing a little as it appears to only be logging rejects and drops and only fw directed accepts. Any ideas would be great. /RObert ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
-- Sergio Alvarez (506)8301342 ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
