You should be able to force switches from the management station, and
hopefully get the firewall to send the accumulated logs back to the
management station.
Try running
fw logswitch -h <name of firewall> -
which should get the firewall to:
1: switch log files
2: transfer the switched logs from that firewall to the management station,
and
3: remove the switched log from the firewall [ use + instead of - to keep
a copy of the logs on the firewall]
You will continue to get log entries being recorded on the remote firewalls
unless they have a consistent good connection to the management station. If
there are problems, you will see a lot of messages in the firewall error log
(fwd.elg, or fwd.log, depending on the version) like
fwd: Log Server xxx.yyy.zzz.www went down
and a lot of messages in the management station error log like
fwd: Remote FireWall aaaa is connected
fwd: End connection from aaaa
where xxx.yyy.zzz.www is the name or IP address of the management station
and aaaa is the name of the firewall object
Hope this helps
--
Timothy Frost mailto:[EMAIL PROTECTED]
EDS New Zealand Fax: +64-4-495-0473
8 Gilmer Terrace Phone: +64-4-495-0504
P O Box 3647
Wellington
New Zealand
> -----Original Message-----
> From: Scott Kellerman [SMTP:[EMAIL PROTECTED]]
> Sent: Wednesday, December 20, 2000 9:37 AM
> To: [EMAIL PROTECTED]
> Subject: [FW1] Logs building up on firewall module...
>
>
> I have several firewall modules in different countries that are managed in
>
> the USA. I noticed on the firewall modules, that there are logs that are
> building up on the firewall module. When I try to do a "logswitch", it
> tells me the operation failed. What is best way to clear up the log
> files,
> and why are they building up on the firewall module as well as the
> management station ?
>
> Thanks....
> _________________________________________________________________
> Get your FREE download of MSN Explorer at http://explorer.msn.com
>
>
>
> ==========================================================================
> ======
> To unsubscribe from this mailing list, please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> ==========================================================================
> ======
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
