# "You have reached the maximum number of active sessions" error in SmartConsole

## Product
Multi-Domain Security Management, Security Management, SmartConsole

## Version
R80 (EOS), R80.10 (EOS), R80.20 (EOS), R80.30 (EOS), R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82, R82.10

## OS
Gaia

## Last Modified
2025-11-18

## Symptoms

- "`You have reached the maximum number of active sessions`" error when trying to connect to Security Management Server / Domain Management Server with SmartConsole, `mgmt_cli` utility, or Management APIs.

- "`Unable to connect to server`" error in SmartConsole (R80 and higher):

- The `$MDS_FWDIR/log/cpm.elg` file on the Management Server (R80 and higher) contains the following line:

`All ID's for ObjectStoreSessionEntity occupied`

## Cause

The number of active sessions is restricted to 100 sessions per administrator and domain.

An active session is a session that was not published and was not discarded.

Typically, this happens when using a script that runs Management API commands to log in and fails to call the applicable Management API commands "publish" or "discard" at the end of the script.

## Solution

To recover from this error and be able to log in again, remove some of your active sessions in **_one_** of these two ways:

- ### Either using the SmartConsole GUI

1. Log in to SmartConsole with another administrator username.

This administrator should have the permission to "Manage Sessions" (typically, a super-admin).
2. On the left Navigation Toolbar, click _**MANAGE & SETTINGS**_.

3. In the upper pane, expand the _**Sessions**_ menu and click _**View Sessions**_.

4. Discard or publish some of the sessions for the administrator who fails to log in.

- ### Or using a special shell script

This shell script will remove all WEB API sessions that were created using either the `mgmt_cli` tool or the Management APIs.

Note: If one of the sessions has unpublished changes in it, that session will _not_ be deleted.

01. Download [this TAR archive](https://support.checkpoint.com/results/download/57375) with the required shell script to your computer.

02. Transfer the downloaded TAR archive from your computer to the Security Management Server / Multi-Domain Management Server (into some directory, e.g., _/some\_path\_to\_fix/_).

03. Connect to the command line on the Security Management Server / Multi-Domain Management Server.

04. Log in to the Expert mode.

05. Extract the required files from the TAR archive:

`[Expert@Mgmt:0]# cd /some_path_to_fix/`

`[Expert@Mgmt:0]# tar -xvf sk113955.tar`

06. Assign the required permissions to the shell script:
      `[Expert@Mgmt:0]# chmod -v a+x /some_path_to_fix/discard_web_api_no_changes.sh`
07. Just in case, convert the shell script from DOS format to UNIX format:
      `[Expert@Mgmt:0]# dos2unix /some_path_to_fix/discard_web_api_no_changes.sh`
08. Check whether Check Point services are up and running:

- On a Security Management Server:

`[Expert@Mgmt:0]# cpwd_admin list`

Note: Output should show "`E`" (executing) in the "`STAT`" column.

- On a Multi-Domain Security Management Server:

`[Expert@Mgmt:0]# mdsstat`

If the services are down, then start them:

- On a Security Management Server:

`[Expert@Mgmt:0]# cpstart`

- On a Multi-Domain Management Server:

`[Expert@Mgmt:0]# mdsstart`
09. If the problem occurred on a _Domain Management Server_, in which you have reached the maximum number of active sessions, then follow these steps ( _**before**_ executing the shell script):

1. Connect with SmartConsole to the Domain Management Server on the Multi-Domain Management Server.

2. On the left Navigation Toolbar, click _**MANAGE & SETTINGS**_.

3. In the upper pane, expand the _**Sessions**_ menu and click _**View Sessions**_.

4. Look at the _**Administrator**_ column.

5. Discard and Disconnect the session, whose "Administrator" is _**WEB\_API**_:

One of the following options can be available in the SmartConsole (depending on the version):

- Either:
           1. Right-click the "WEB\_API" session and then click the _**Discard & Disconnect**_ option.

2. Click _**Yes**_ to confirm.
         - Or:
           1. Right-click the "WEB\_API" session and then click the _**Discard**_ option.

2. Right-click the "WEB\_API" session and then click the _**Disconnect**_ option.

3. Click _**Yes**_ to confirm.
      6. Close the SmartConsole.
10. Execute the shell script:

`[Expert@Mgmt:0]# ./some_path_to_fix/discard_web_api_no_changes.sh`

_Example:_

> ```
      > Going to discard 5 web_api worksessions.
      > About to discard worksession: 88a308de-8b97-43a7-bcd0-52905faf1225
      > message: "OK"
      > number-of-discarded-changes: 0
      > 
      > About to discard worksession: b31f50a8-ea8d-4008-98c7-84f0e3dcf6bf
      > message: "OK"
      > number-of-discarded-changes: 0
      > 
      > About to discard worksession: c76bbcb5-231f-49d9-bb63-d5146b5901ea
      > message: "OK"
      > number-of-discarded-changes: 0
      > 
      > About to discard worksession: 90eca66b-3195-4508-8d4a-7887161eaf7f
      > message: "OK"
      > number-of-discarded-changes: 0
      > 
      > About to discard worksession: 5afc638e-ba04-4700-bf2a-483d00a4c9a3
      > message: "OK"
      > number-of-discarded-changes: 0
      > 
      > message: "OK"
      > number-of-discarded-changes: 0
      > 
      > message: "OK"
      > 
      > Finished.
      > Note: List of WEB_API worksessions that were closed: api_sessions.txt
      > ```

**Warnings**
  - While running the _discard\_web\_api\_no\_changes.sh_ script, the following messages may appear:

```
    [Expert@Mgmt:0]# ./discard_web_api_no_changes.sh
    Going to discard 2353 web_api worksessions.
    Error: Failed to login to the management server
    ```

This happens because _WEB\_API_ reached maximum allowed connections, and therefore the Management Server prohibits any additional attempt to log in.

The following workaround is available:

Edit the _discard\_web\_api\_no\_changes.sh_ script in Vi editor and change the "login" line from:

`mgmt_cli login -r true < id.txt;`

to:

`mgmt_cli login user <USER_NAME> password <PASSWORD> > id.txt;`
  - If in the Management Server object you configured Gaia Portal (Multi-Portal) to use a port other than the default 443, then while running the _discard\_web\_api\_no\_changes.sh_ script, the following message may appear:

```
    [Expert@Mgmt:0]# ./discard_web_api_no_changes.sh
    Going to discard 17 web_api worksessions.
    ```

Edit the _discard\_web\_api\_no\_changes.sh_ script in Vi editor and change the "login" line from:

`mgmt_cli login -r true > id.txt;`

to (example is for the port 4434):

`mgmt_cli login --port 4434 -r true > id.txt;`

### Related Documentation

- Security Management Server Administration Guide for your version.
- Multi-Domain Management Administration Guide for your version.
- [Management API Reference](https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction).

**Related Solution:**

- [sk120993 - "getting domain name failed" error when running "vsec\_config" command on vSEC Controller](https://support.checkpoint.com/results/sk/sk120993)