sk113955 - "You have reached the maximum number of active sessions" error in SmartConsole

"You have reached the maximum number of active sessions" error in SmartConsole

Product

Multi-Domain Security Management, Security Management, SmartConsole

Version

R80 (EOS), R80.10 (EOS), R80.20 (EOS), R80.30 (EOS), R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82, R82.10

OS

Gaia

Last Modified

2025-11-18

Symptoms

"You have reached the maximum number of active sessions" error when trying to connect to Security Management Server / Domain Management Server with SmartConsole, mgmt_cli utility, or Management APIs.
"Unable to connect to server" error in SmartConsole (R80 and higher):
The $MDS_FWDIR/log/cpm.elg file on the Management Server (R80 and higher) contains the following line:

All ID's for ObjectStoreSessionEntity occupied

Cause

The number of active sessions is restricted to 100 sessions per administrator and domain.

An active session is a session that was not published and was not discarded.

Typically, this happens when using a script that runs Management API commands to log in and fails to call the applicable Management API commands "publish" or "discard" at the end of the script.

Solution

To recover from this error and be able to log in again, remove some of your active sessions in one of these two ways:

Either using the SmartConsole GUI

This administrator should have the permission to "Manage Sessions" (typically, a super-admin). 2. On the left Navigation Toolbar, click MANAGE & SETTINGS.

In the upper pane, expand the Sessions menu and click View Sessions.
Discard or publish some of the sessions for the administrator who fails to log in.

Or using a special shell script

This shell script will remove all WEB API sessions that were created using either the mgmt_cli tool or the Management APIs.

Note: If one of the sessions has unpublished changes in it, that session will not be deleted.

Download this TAR archive with the required shell script to your computer.
Transfer the downloaded TAR archive from your computer to the Security Management Server / Multi-Domain Management Server (into some directory, e.g., /some_path_to_fix/).
Connect to the command line on the Security Management Server / Multi-Domain Management Server.
Log in to the Expert mode.
Extract the required files from the TAR archive:

[Expert@Mgmt:0]# cd /some_path_to_fix/

[Expert@Mgmt:0]# tar -xvf sk113955.tar

Assign the required permissions to the shell script: [Expert@Mgmt:0]# chmod -v a+x /some_path_to_fix/discard_web_api_no_changes.sh
Just in case, convert the shell script from DOS format to UNIX format: [Expert@Mgmt:0]# dos2unix /some_path_to_fix/discard_web_api_no_changes.sh
Check whether Check Point services are up and running:

On a Security Management Server:

[Expert@Mgmt:0]# cpwd_admin list

Note: Output should show "E" (executing) in the "STAT" column.

On a Multi-Domain Security Management Server:

[Expert@Mgmt:0]# mdsstat

If the services are down, then start them:

On a Security Management Server:

[Expert@Mgmt:0]# cpstart

On a Multi-Domain Management Server:

[Expert@Mgmt:0]# mdsstart 09. If the problem occurred on a Domain Management Server, in which you have reached the maximum number of active sessions, then follow these steps ( before executing the shell script):

Connect with SmartConsole to the Domain Management Server on the Multi-Domain Management Server.
On the left Navigation Toolbar, click MANAGE & SETTINGS.
In the upper pane, expand the Sessions menu and click View Sessions.
Look at the Administrator column.
Discard and Disconnect the session, whose "Administrator" is WEB_API:

One of the following options can be available in the SmartConsole (depending on the version):

Either: 1. Right-click the "WEB_API" session and then click the Discard & Disconnect option.

Click Yes to confirm. - Or: 1. Right-click the "WEB_API" session and then click the Discard option.
Right-click the "WEB_API" session and then click the Disconnect option.
Click Yes to confirm.
1. Close the SmartConsole.
Execute the shell script:

[Expert@Mgmt:0]# ./some_path_to_fix/discard_web_api_no_changes.sh

Example:

Going to discard 5 web_api worksessions.
About to discard worksession: 88a308de-8b97-43a7-bcd0-52905faf1225
message: "OK"
number-of-discarded-changes: 0

About to discard worksession: b31f50a8-ea8d-4008-98c7-84f0e3dcf6bf
message: "OK"
number-of-discarded-changes: 0

About to discard worksession: c76bbcb5-231f-49d9-bb63-d5146b5901ea
message: "OK"
number-of-discarded-changes: 0

About to discard worksession: 90eca66b-3195-4508-8d4a-7887161eaf7f
message: "OK"
number-of-discarded-changes: 0

About to discard worksession: 5afc638e-ba04-4700-bf2a-483d00a4c9a3
message: "OK"
number-of-discarded-changes: 0

message: "OK"
number-of-discarded-changes: 0

message: "OK"

Finished.
Note: List of WEB_API worksessions that were closed: api_sessions.txt

Warnings

While running the discard_web_api_no_changes.sh script, the following messages may appear:

    [Expert@Mgmt:0]# ./discard_web_api_no_changes.sh
    Going to discard 2353 web_api worksessions.
    Error: Failed to login to the management server
    ```

This happens because _WEB\_API_ reached maximum allowed connections, and therefore the Management Server prohibits any additional attempt to log in.

The following workaround is available:

Edit the _discard\_web\_api\_no\_changes.sh_ script in Vi editor and change the "login" line from:

`mgmt_cli login -r true < id.txt;`

to:

`mgmt_cli login user <USER_NAME> password <PASSWORD> > id.txt;`
  - If in the Management Server object you configured Gaia Portal (Multi-Portal) to use a port other than the default 443, then while running the _discard\_web\_api\_no\_changes.sh_ script, the following message may appear:

[Expert@Mgmt:0]# ./discard_web_api_no_changes.sh
Going to discard 17 web_api worksessions.
```

Edit the discard_web_api_no_changes.sh script in Vi editor and change the "login" line from:

mgmt_cli login -r true > id.txt;

to (example is for the port 4434):

mgmt_cli login --port 4434 -r true > id.txt;