Useful commands and log files

Back to Endpoint Check the Check Point services running:

cpwd_admin list

Stop and Start UEPM services:

uepm_stop

uepm_start

UEPM Logs Directory:

$UEPMDIR/logs

server_messages.log - Sync Errors / Client issues

tail -f $UEPMDIR/logs/server_messages.log

This file is very useful when determining if management/policy servers are able to sync

[2016-10-22 20:52:26,091]  INFO Dispatcher-Thread-11 - Retrieved file: sic://172.16.0.1:18193/cp/file/45/28bf92a2-7673-43de-acca-8c3abf524253 and saved to local path: /opt/CPuepm-R77/engine/webapps/CP/cache/DP/28bf92a2-7673-43de-acca-8c3abf524253.0 (FileDownloader)
[2016-10-22 20:52:27,084]  INFO Dispatcher-Thread-11 - Retrieved file: sic://172.16.0.1:18193/cp/file/77/44678a8a-a1d4-4b93-9cdf-ed04dc6274f8 and saved to local path: /opt/CPuepm-R77/engine/webapps/CP/cache/URL_FILTERING/44678a8a-a1d4-4b93-9cdf-ed04dc6274f8.0 (FileDownloader)
[2016-10-22 20:52:27,360]  INFO Dispatcher-Thread-11 - Retrieved file: sic://172.16.0.1:18193/cp/file/10/03f9726e-5221-4fa7-ae1e-47e7d171699d and saved to local path: /opt/CPuepm-R77/engine/webapps/CP/cache/FW/03f9726e-5221-4fa7-ae1e-47e7d171699d.0 (FileDownloader)
[2016-10-22 20:52:27,643]  INFO Dispatcher-Thread-11 - Retrieved file: sic://172.16.0.1:18193/cp/file/35/11152d3d-0137-4ca0-972c-079badb30116 and saved to local path: /opt/CPuepm-R77/engine/webapps/CP/cache/FDE_DEVICE/11152d3d-0137-4ca0-972c-079badb30116.0 (FileDownloader)
[2016-10-22 20:52:27,973]  INFO Dispatcher-Thread-11 - Retrieved file: sic://172.16.0.1:18193/cp/file/100/6236a4eb-8119-4126-94cf-8bfab446011b and saved to local path: /opt/CPuepm-R77/engine/webapps/CP/cache/ANTIBOT/6236a4eb-8119-4126-94cf-8bfab446011b.0 (FileDownloader)
[2016-10-22 20:52:29,198]  INFO Dispatcher-Thread-11 - Retrieved file: sic://172.16.0.1:18193/cp/file/6/d10dd20c-0c1c-4c9c-a653-2d13b60ae927 and saved to local path: /opt/CPuepm-R77/engine/webapps/CP/cache/SD/d10dd20c-0c1c-4c9c-a653-2d13b60ae927.0 (FileDownloader)
[2016-11-01 17:17:13,196]  INFO Dispatcher-Thread-10 - Finished synchronizing with EPS server. (ConnectionPointStateMachine)

It's also useful to check for GIU client issues (see enable debug mode) and also endpoint client connectivity issues.

[2016-11-02 00:16:48,040] ERROR Dispatcher-Thread-10 - A server exception occurred while handling an endpoint request. Request size: 3271, scheme: http, port: 80, uri: /cp/connectionPoint/syncreq, ip: /172.160.1:55893, opType: SYNC_REQUEST, useZpdoc: true (ConnectionPointServlet)

apache_access.log – Client Connectivity issues

tail -f $UEPMDIR/logs/apache_access.log

This is useful when checking if the EPM service is working correctly.

Checking the HTTP status code clients get when accessing the server give a good indication of server health.

HTTP 200 – Working

-, 172.16.0.1 - - [02/Nov/2016:15:49:18 +0000] "POST /cp/connectionPoint/hb HTTP/1.1" 200 662 0/1110 "-" "-"
-, 172.16.0.2 - - [02/Nov/2016:15:49:18 +0000] "POST /cp/connectionPoint/hb HTTP/1.1" 200 666 0/1057 "-" "-"
-, 172.16.0.1 - - [02/Nov/2016:15:49:18 +0000] "GET /cp/connectionPoint/syncreq HTTP/1.1" 200 159 0/561 "-" "-"
-, 172.16.0.2 - - [02/Nov/2016:15:49:18 +0000] "GET /cp/connectionPoint/syncreq HTTP/1.1" 200 159 0/422 "-" "-"

HTTP 500 – Not working - Internal Server Error

-, 172.16.0.1 - - [02/Nov/2016:15:55:11 +0000] "POST /cp/connectionPoint/hb HTTP/1.1" 500 670 0/1120 "-" "-"
-, 172.16.0.2 - - [02/Nov/2016:15:55:11 +0000] "POST /cp/connectionPoint/hb HTTP/1.1" 500 670 0/1058 "-" "-"
-, 172.16.0.1 - - [02/Nov/2016:15:55:11 +0000] "GET /cp/connectionPoint/syncreq HTTP/1.1" 500 159 0/606 "-" "-"
-, 172.16.0.2 - - [02/Nov/2016:15:55:11 +0000] "GET /cp/connectionPoint/syncreq HTTP/1.1" 500 159 0/642 "-" "-"