> Source: [sk109038](https://support.checkpoint.com/results/sk/sk109038) # sk109038 - Messages in /var/log/messages file that can be ignored | Property | Value | |----------|-------| | Solution ID | sk109038 | | Date Created | 2015-12-16 | | Last Modified | 2025-06-23 | | Technical Level | General | | Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server | | Versions | R82, R81.20, R81.10 (EOS), R82, R81.20, R81 (EOS), R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82 | | OS | Gaia | ## Solution **This article consolidates all messages and warnings located in */var/log/messages* files, that can be safely ignored.** Click here to see safe messages for other products and files. Click Here to Show the Entire Article 1. **FW-1: Warning: Interface is defined but not currently present**`. ` Show / Hide the Details This is an informational message that not necessarily indicates a problem. When a Bond or Bridge interface is configured, this message may appear for the individual slave interfaces. This is due to the way internal processes look at configuration data. If the ethX interface is part of a Bond or a Bridge, then these slave interfaces may appear to be "not present" when considered individually by internal processes.
2. **[DATE TIME] firewall [LOG_WARNING] ipsrd[PID]: dvmrp_recv_prune: duplicate prune from for (, 192.168)/48, time remaining 900 seconds** Show / Hide the Details This log indicates that the gateway has received a second DVMRP prune message from a downstream router before the previous prune message expired. The expiration timer is set by the downstream host in the initial DVMRP prune message. It is not expected that the downstream host would send more than one prune message. If the downstream host tries to update the expiration timer for a particular pruned route, gateway will update the expiration timer with the information from the new message. Manipulation of the expiration timer, however, is not considered by the DVMRP standard to be a usual means by which multicast routing should be manipulated. Hence the gateway will issue this message if the time remaining on the expiration timer is significant. If this message occurs frequently or otherwise become problematic, a network administrator should investigate why the downstream router is sending multiple prune messages for the same multicast group address.
3. **Cluster:Failed to send packet on eth1c0: No buffer space available** Show / Hide the Details This message does not signify lost packets, as the message may imply. It is simply a warning of an error state as packet data is passed between different portions of the Security gateway kernel code. The following variables affected the generation of this message: * The greater the number of cluster members, the greater the likelihood of seeing the error * The greater the overall load on the units, the greater the likelihood of seeing the message * The weaker the hardware used in the cluster, the greater the likelihood of seeing the message * The greater the number of port connections on a per-destination IP address basis, the greater the likelihood of seeing the error If the message is experienced continuously, consider upgrading your gateway to the most recent version or installing more powerful hardware.
4. **[DATE TIME] cpmodule kernel: FW-1: Warning: The bond0 interface is not protected by the anti-spoofing feature** - message appears during policy installation when gateway is configured with bond interface and logical VLAN interfaces on top. Show / Hide the Details Policy install detects the root bond interface that is not configured with any IP address. It warns about it, although this interface is not participating in the network flow. These messages can be safely ignored if the interface is configured without any IP address. Root bond interface must not have any IP address, if a VLAN is configured on top. The configured anti-spoofing mechanism works for the rest of the VLANS configured on top of the root bond interface.
5. */var/log/messages* shows the following warnings from SNMPD daemon: **snmpd: snmpd startup succeeded snmpd[PID]: Turning on AgentX master support. snmpd[PID]: /etc/snmp/snmpd.conf: line X: Warning: Unknown token: cp_cleartrap. snmpd[PID]: /etc/snmp/snmpd.conf: line Y: Warning: Unknown token: cp_monitor. snmpd[PID]: /etc/snmp/snmpd.conf: line Z: Warning: Unknown token: cp_pcommunity. snmpd[PID]: NET-SNMP version 5...** Show / Hide the Details The**snmpd** daemon does not recognize non-standard NET-SNMP configuration - in this case, it does not recognize the configuration of Check Point's daemon **cpsnmpagentx** (such as *cp_pcommunity* , *cp_monitor* , *cp_cleartrap*) - and just ignores these lines while printing the warning message.
6. */var/log/messages* file shows: * **routed[PID]: CLUSTER: Proto 7 enables sending in Cluster** * **routed[PID]: OspfClusterTransition(...): slave to slave event ignoring**

Show / Hide the Details The first message is a house-keeping message and the second one is a log of a non-event. They can be ignored.
7. "**Informatory: the current security gateway license allows for only N internal hosts***"* Show / Hide the Details This message is informatory only and is not indicative of the internal host limit being reached. It is automatically generated and can be ignored. For software blade licensing, core count can be determined by the amount of cores in the license: * Open Server: 1 core licenses allow 50 users, 2 core licenses allow 500 users, 4+ core licenses allow unlimited internal users. * Check Point Appliances: Check Point appliances allow unlimited internal users regardless of core count. For information related to troubleshooting internal host warnings, refer to [sk10200](http://supportcontent.checkpoint.com/solutions?id=sk10200).
8. "**gated[PID]: io_receive_packet: KRT recvmsg: No buffer space available**" message on the cluster standby member during failover, when *fibmgrd* writes the routes received from the master and *gated* reads them. Show / Hide the Details *gated* ignores *fibmgrd* routes, so losing some of the fibmgrd route updates is harmless. Im this case the messages can be ignored.
Another option - the message only appeared on the active cluster member and during a policy installation. If a failover occurred during the policy installation, then those are *fibmgrd* routes being synced while *gated* reads from the kernel and there should not be a problem since *gated* ignores them already. The cause is that *fibmgrd* updates kernel with route information while *gated* reades the route information from the kernel. *Fibmgrd* does bulk updates so when there are many routes, *fibmgrd* tries to write all of them, one after the other. If *gated* reads from the kernel at this time, some of the updates might be lost to *gated* . Since *gated* does not care about *fibmgrd* routes, it is ok to lose those updates. *fibmgrd* will need to mass update the routes during failover. Usually, *fibmgrd* needs to do small updates, as routes are not all learned at the same time.
9. */var/log/messages* file on VRRP cluster members repeatedly shows messages similar to: **kernel: eth2.60: dev_set_promiscuity(master, -1) kernel: device eth2.60 left promiscuous mode kernel: eth2.100: dev_set_promiscuity(master, -1) kernel: device eth2.100 left promiscuous mode kernel: eth2.24: dev_set_promiscuity(master, -1) kernel: device eth2.24 left promiscuous mode** Show / Hide the Details When VRRP is enabled, the interface is put in promiscuous mode. Linux kernel does not have support to identify traffic addressed to the Virtual MAC address - the MAC address associated with the VRRP Virtual IP address. As such, the interface is placed in promiscuous mode, and all traffic is examined by the Linux kernel. The packets addressed to the VMAC address are identified and forwarded to the FireWall and other modules.
10. Error messages related to '*fwloghandle_check_string* ' in */var/log/messages* file: **fwloghandle_check_string: invalid char in string (ascii** **-127)** **fwloghandle_register_string_obfuscated: failed to obfuscate given string!** In addition, Custom Application Control and URL Filtering application was created with Traditional Chinese characters placed into the description field. The custom application is placed into a rule to drop the traffic initiated from the client PC. Show / Hide the Details This is a current limitation of the string dictionary. At this time, Unicode, in this case Traditional Chinese, characters are not supported by the Security Gateway, which is what is causing this particular message to be seen in the */var/log/messages* file. Check Point RnD are working on including support for Traditional Chinese characters in the description field in a future major release. The software release, in which this functionality will be supported, has yet to be determined.
11. *"* **fwx_get_original_conn_key_ex: couldn't get conn key from chain**" appears in */var/log/messages* file Show / Hide the Details This is a legitimate and harmless message that occurs when looking for a connection that has got out from the Connections Table (for example, due to timeout, early expiration, etc.) These messages appear in the */var/log/messages* since the "warning" debug in the fw module is on. It is not recommended to turn it off as there are messages generated by the "warning" flag that might indicate an issue and can help with the troubleshooting process. If required, these messages can be removed from the appearing in the messages files by removing the "warning" flag from the fw module. This can be done using the command: *# fw ctl debug -m fw - warning* To add the "warning" flag back, this command should be run on the Security Gateway in order to default the debug values: *# fw ctl debug 0*
12. "**fwconnoxid_msg_get_cliconn: warning - failed to get connoxid message**" or "**fwconnoxid_msg_get_cliconn: warning - failed to get connoxid kbuf**" appears in kernel debug. Show / Hide the Details These messages are printed because of '*conn* ' debug flag in 'FW' module (*fw ctl debug -m fw + conn*) and can be ignored. These are informational messages that not necessarily indicate a problem. The *fwconnoxid_msg_get_cliconn* function tries to get the client connection before the server connection exists.
13. */var/log/messages* file repeatedly shows: **[ctipd][PID]: CIpRepCache::Save() - Saved to file /opt/CPsuite-R77/fw1/tmp/email_tmp/aspam_engine/ctipd.cache** **[ctipd][PID]: CIpRepCache::Save() - Saved to file /opt/CPsuite-R77/fw1/tmp/email_tmp/aspam_engine/ctipd.cache_v6** **[ctipd][PID]: CEnginesContainer::UpdateSettings() - Updating** Show / Hide the Details These messages appear when Commtouch IP Reputation cache is periodically saved on the hard disc (by default, every 60 minutes). These are messages are harmless and can be safely ignored. If you want to change the interval of saving the Commtouch IP Reputation cache on the hard disc, then following these steps: 1. Connect to command line on Security Gateway. 2. Log in to Expert mode. 3. Backup the current */opt/aspam_engine/ctipd/conf/ctipd.conf* file: **[Expert@HostName]# cp /opt/aspam_engine/ctipd/conf/ctipd.conf /opt/aspam_engine/ctipd/conf/ctipd.conf_ORIGINAL**` ` 4. Edit the current */opt/aspam_engine/ctipd/conf/ctipd.conf* file: **[Expert@HostName]# vi /opt/aspam_engine/ctipd/conf/ctipd.conf**` ` 5. Go to the following section: ``` # Periodic save interval in minutes, use 0 to disable periodic save # CacheSaveInterval = 60 ``` 6. Uncomment the line with "**CacheSaveInterval = 60**" (remove the # character). 7. Set the desired value in minutes for the *CacheSaveInterval* attribute. Use 0 to disable periodic save. 8. Save the changes and exit from Vi editor. 9. Restart Check Point services: **Note:** This will stop all current connections. **[Expert@HostName]# cpstop ; cpstart**
14. "**igmp_recv: packet from non-local neighbor X.X.X.X**" error appears on the console and in the */var/log/messages* file. Show / Hide the Details This harmless message signifies that a packet received from a neighbor that is not present on any network interfaces. Efforts have been made to match the source address with any of the connected networks, but a failure has occurred to match this packet to anyone of them.
15. */var/log/messages* file on cluster member(s) repeatedly shows: * **`kernel: [fw...];Global param: set int fw_is_running_on_cbs to '1'`** **`kernel: [fw...];Global param: set int fwha_cbs_which_member_is_running_gated to '0'`** **`kernel: [fw...];FW-1: fwha_validate_member_running_gated: 0 is not a valid member id`** * **`kernel: [fw...];Global param: set int fw_is_running_on_cbs to '1'`** **`kernel: [fw...];Global param: set int fwha_cbs_which_member_is_running_gated to '2'`**
Show / Hide the Details These messages can be ignored, they are part of an internal mechanism between the *routed* daemon and the Firewall. Explanation: * Value of kernel parameter *fw_is_running_on_cbs* is set to 1 (one) in VRRP cluster and in cluster running on X-Series chassis * Value of kernel parameter *fwha_cbs_which_member_is_running_gated* is set to the ID of a cluster member that runs as the Dynamic Routing "Master" (the routing daemon can be Master only on one cluster member)

16. */var/log/messages* file on cluster member(s) repeatedly shows the following: * `routed[PID]: ifa_set_unnumbered: addresses forinterface before....... : local: int address: 0.0.0.0 matc` `routed[PID]: ifa_set_unnumbered: Exiting` `last message repeated 53 times`
Show / Hide the Details The messages can be ignored. You can configure Gaia OS to write the RouteD daemon's syslog messages to the */var/log/routed_messages* file instead of the default */var/log/messages* file - follow [sk116436 - How to redirect the RouteD daemon's syslog messages](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116436).
17. When *routed syslog* is enabled, the */var/log/messages* file shows: **routed[PID]: routed_syslog_on: tracing to "/var/log/routed_messages" started kernel: Passive ARP hook already uninstalled!** Show / Hide the Details The messages can be ignored.
18. Message is printed in */var/log/messages* : **xpand[pid]: error reading database request** Show / Hide the Details This is an indication that one transaction to the database was not successful. If it is not seen in big numbers, it does not indicates on real issue. If it does appear in big numbers, it could be a symptom of confd issue, which is the daemon responsible for configuration. In such case collect all */var/log/messages* \* files and machine [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) file, and [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to open a service request.
19. Netflow logs appear in*/var/log/messages* , although netflow is not enabled. Example of netflow logs: **`DATE TIME HOSTNAME fwd: netflow_shm_init: Allocating netflow shared memory for sequence numbers`** **`DATE TIME HOSTNAME fwd: netflow shm mem does not exist`** **`DATE TIME HOSTNAME fwd: netflow shm mem created`** **`DATE TIME HOSTNAME fwd: netflow_post_conf_change: c->nfliveconn_interval 0`** **`DATE TIME HOSTNAME fwd: netflow_post_conf_change: not able to set kiss value to netflow_enable_flags 0`** **`DATE TIME HOSTNAME fwd: netflow_post_conf_change: not able to set kiss value to netflow_liveconn_interval 0`** Show / Hide the Details These messages are harmless and may be ignored. This problem was fixed. The fix is included in: * [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 101 * [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 177 If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/.contact-support/) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case. **Hotfix installation instructions:** Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).


--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content