> Source: [sk103744](https://support.checkpoint.com/results/sk/sk103744)

# sk103744 - "Out of state" logs are not seen on cluster after grace period

| Property | Value |
|----------|-------|
| Solution ID | sk103744 |
| Date Created | 2014-12-18 |
| Last Modified | 2014-12-23 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * After 60 seconds of inactivity, when the connection should be expired (TCP service configured for minimal possible timeout of 60 seconds), a packet is sent and no "Out of state" log is seen in SmartView Tracker.  

* Debug for SIM and FW modules shows:   
  The connection expires:   

  `;fwconn_ent_expire: SXL/FLOWS decision: expire, new timeout=0, new ttl=0; `  
  `
  ;ld_expire: Entry c7cf0100 in table connections(8158) now expired; `  
  `
  ;ex_expire_ent: calling ld_del; `  
  `
  ;ld_del_ex: d=8158 lp=connections tuple=<...6-tuple in hex...>; `  
  `
  ;h_delete: hp=c80bd3d8 tuple=< ...6-tuple in hex... >; `  
  `
  ;hi_deleted: hp=c80bd3d8 h=c7cf0100; `  
  `
  ;hi_deleted: calling c25f5280 with 0. h=c7cf0100; `  
  `
  ;fwconn_expire: conn ... IP address:port -> IP address:port IPP 6...; `  
  `
  ;ld2_get_wto_ttl_aggr: d=8158 lp=connections tuple=<0,a201497,a48,ac1931b9,15,6>;`   

  <br />

  And then the connection is renewed in connections table for 10 more seconds:   

  `;fwconn_ent_expire: SXL/FLOWS decision: delay, new timeout=0, new ttl=10; `  
  `
  ;ld_expire: Entry c7cf0100 in table connections(8158) rescheduled for 10 more seconds;`

## Cause

To prevent the excessive amount of logs, by default there would be a period of 62 seconds in which additional logs for the same flow will not be recorded. This configuration is called "Excessive log grace period" and is located in SmartDashboard -\> General Properties -\> Logs and Alerts -\> Time Settings.

In a cluster environment, an expired connection will be prolonged for additional 10 seconds as delete delta sync. In other words, the connection will remain in connections table for 10 more seconds to allow cluster members to synchronize and delete connection. During this period logs are also will not be issued.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content