# Security Gateway stops logging locally or to assigned Log Servers

**Product**: ClusterXL, Security Gateways  
**Version**: R80.30 (EOS), R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82  
**OS**: Gaia  
**Last Modified**: 2025-01-20

## Symptoms

- Security Gateway / Cluster Member stops logging locally or to configured Log Servers.
- "`FwKluProcessLogEx: fail to convert klog buffer to unified fragment`" line appears repeatedly in the `$FWDIR/log/fwd.elg` log file on a Security Gateway / Cluster Member.

## Cause

The file _fw.logtrack_ file on Security Gateway / Cluster Member is corrupted. This may be caused by extremely high load on the FWD daemon.

## Solution

**Critical:** You must schedule a maintenance window to perform this procedure. Because this procedure stops the FWD daemon, it may cause a traffic outage, and a failover in a cluster.

1. Connect to the command line on the Security Gateway / Cluster Member.  
2. Log in to the Expert mode  
3. Terminate the FWD daemon:
   
   ```bash
   cpwd_admin stop -name FWD -path "$FWDIR/bin/fw" -command "fw kill fwd"
   ```
4. Delete the corrupted _fw.logtrack_ file:
   
   ```bash
   rm -i $FWDIR/log/fw.logtrack
   ```
5. Start the FWD daemon:
   
   ```bash
   cpwd_admin start -name FWD -path "$FWDIR/bin/fw" -command "fwd"
   ```
6. Examine the local logging - the sizes of the local log files must change:
   
   ```bash
   watch -d -n 1 "ls -l $FWDIR/log/fw.log*"
   ```
7. Examine the remote logging - SmartConsole must show logs from this Security Gateway / Cluster Member.

This problem was fixed. The fix is included in:

- [Check Point Quantum R82](https://support.checkpoint.com/results/sk/sk181127)  
- [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 54  
- [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 141  
- [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 99  
- [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 211

If you choose not to upgrade, Check Point can supply a **Hotfix**. [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**  
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

## Part 1 - Delete the corrupted _fw.logtrack_ file:

## Part 2 - Configure an environment variable:

1. Connect to the command line on the Security Gateway / **each** Cluster Member.  
2. Log in to the Expert mode  
3. Back up the current _$CPDIR/tmp/.CPprofile.sh_ file:
   
   ```bash
   cp -v $CPDIR/tmp/.CPprofile.sh{,_BKP}
   ```
4. Edit the current _$CPDIR/tmp/.CPprofile.sh_ file:
   
   ```bash
   vi $CPDIR/tmp/.CPprofile.sh
   ```
5. Add this line - somewhere between the existing environment variables, and not at the end of the file:
   
   ```bash
   KLOG_CONVERTER_ENV_VAR=800; export KLOG_CONVERTER_ENV_VAR ; hash 1>/dev/null 2>&1
   ```
6. Save the changes in the file and exit Vi editor.  
7. Reboot the Security Gateway / each Cluster Member.

#### NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

## Article Properties

**Access Level**: General  
**Status**: Approved by TAC  
**Date Created**: 2020-11-04  
**Last Modified**: 2025-01-20