> Source: [sk110972](https://support.checkpoint.com/results/sk/sk110972) # sk110972 - Check Point Private ThreatCloud - Troubleshooting | Property | Value | |----------|-------| | Solution ID | sk110972 | | Date Created | 2016-04-12 | | Last Modified | 2021-12-16 | | Technical Level | General | | OS | Gaia | | Platform | Smart-1 | ## Solution This article describes issues that might be encountered when working with [sk110394 - Check Point Private ThreatCloud](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110394). **Note:** In case of alerts or failures that are seen for the first time on the PTC/DA, it is recommended to run *ptc_stop;ptc_start* to restart all PTC services. Restarting PTC services can resolve some of the known errors, since actions are performed a bit differently on service reload compared to run time. Click Here to Show the Entire Article 1. **Emergency restore is required** > > |-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Possible scenario | The Private ThreatCloud powers off unexpectedly. The usual commands do not work. | > | Solution | Perform an emergency restore: 1. Connect to the command line on Private ThreatCloud. 2. Log in to Expert mode. 3. Perform a restore: ***\[Expert@HostName:0\]# /opt/CPtms/cur/scripts/ptc_restore.sh -l*** |

2. High CPU utilization consumed by one specific process. > 1. Restart PTC services as follows: > *# ptc_stop ; ptc_start* > 2. Once restarted, monitor machine behavior using TOP command output and in case issue persists, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/).
3. Accessing the Private ThreatCloud Gateway logs > The Private ThreatCloud Gateway can send logs either to the Security Management Server / Multi-Domain Security Management Server managing your Private ThreatCloud Gateway, or to an external separate Log Server, depending on your choice. > * Follow these steps if you would like to send logs from the Private ThreatCloud Gateway to the Security Management Server / Multi-Domain Security Management Server managing your Private ThreatCloud Gateway: > > 1. Connect with SmartLog GUI client to the Security Management Server / Domain Management Server managing your Private ThreatCloud Gateway. > > 2. In the upper left corner, click on the yellow star - ***Favorites*** (or press CTRL+B keys). > > 3. In the ***Predefined*** category, click on the ***ThreatCloud Appliance***. > > 4. You can click on ***All*** to view all events, including informational messages, or click on ***Alerts*** to only view the existing problems. > > * Follow these steps if you would like to send logs from the Private ThreatCloud Gateway to the external separate Log Server: > > 1. Copy the Private ThreatCloud Add-On package ***/home/admin/ptc_mgmt_addon.rpm*** from your Private ThreatCloud to the external separate Log Server (to */home/admin/* directory). > > 2. Connect to the command line the external separate Log Server. > > 3. Log in to Expert mode. > > 4. Install the Private ThreatCloud Add-On package: > > ***\[Expert@HostName:0\]# cd /home/admin/*** > ***\[Expert@HostName:0\]# rpm -ihv ptc_mgmt_addon.rpm*** > 5. Connect with SmartLog GUI client to the Security Management Server / Domain Management Server managing your Private ThreatCloud Gateway. > > 6. In the upper left corner, click on the yellow star - ***Favorites*** (or press CTRL+B keys). > > 7. In the ***Predefined*** category, click on the ***ThreatCloud Appliance***. > > 8. You can click on ***All*** to view all events, including informational messages, or click on ***Alerts*** to only view the existing problems.

4. Cannot configure a Check Point device to work with the Private ThreatCloud > > |-------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Possible scenario | You are configuring a Check Point device to work with the Private ThreatCloud, and the configuration fails with an error message. | > | Possible cause | The Check Point device you are trying to configure, cannot communicate with the issuer of the certificate on the Private ThreatCloud. The issuer is *another* Security Management Server that manages the Private ThreatCloud. | > | Solution | Follow the steps below in the given order. Note: In case one step resolves the issue, there is no need to continue to the next step. 1. Verify there is HTTP and HTTPS connectivity between the Check Point device and the Private ThreatCloud. 2. If a DNS server is configured on the Check Point device, make sure it is reachable by the Check Point device (e.g., try looking up a hostname from the command line). 3. Remove the name resolution for the CRL point from the Check Point device's DNS server: 1. Determine what is the CRL you should use by viewing the certificate. To view the certificate, connect in your web browser to ***https://\*** and choose to view the site's certificate. In the certificate details, look at the "***CRL Distribution Points***" line. The URL of CRL Distribution Point would be something like this: ***http://\:18264/ICA_CRL0.crl***. 2. On the DNS server, remove the entry for the CRL Distribution Point's host name (in the example above - ``). 4. Add a fake entry with the host name of CRL Distribution Point and the IP address of 0.0.0.1: Note: These steps can be performed only in Gaia Clish. 1. Connect to the command line on the Check Point device you are trying to configure to work with the Private ThreatCloud. 2. Log in to Gaia Clish. 3. Add the host entry with the host name of CRL Distribution Point: ***HostName\> add host name \ ipv4-address 0.0.0.1*** 4. Save the Gaia Configuration: ***HostName\> save config*** 5. Verify: ***HostName\> show host names*** | > | Related solutions | * [sk110363 - Domain Name that was configured in First Time Configuration Wizard does not appear in the /etc/hosts file on Gaia OS](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110363) |

5. Logs show "*will retry later*" errors from Download Agent > > |-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Possible scenario | In the SmartLog GUI, in Download Agent monitoring and in the logs, there are errors about failed downloads, that include the text: "*will retry later*". | > | Explanation | This happens sometimes due to different temporary / initial issues. These errors usually clear out after the next download retry. They can be ignored and should disappear within a couple of hours. |

6. Connectivity error from the Download Agent > > |-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Possible scenario | In the SmartLog GUI and in SmartView Monitor, in the Download Agent monitoring and in the logs, the following or similar connectivity errors are shown: *Could not update from PA service; error: java.net.UnknownHostException: ptcs.checkpoint.com: ptcs.checkpoint.com* | > | Possible cause | The DNS of the Download Agent changed. | > | Solution | Restart the Private ThreatCloud services on the Download Agent, or on the Private ThreatCloud in a Single Box deployment (when ThreatCloud and the Download Agent are installed on the same appliance). 1. Connect to the command line to the Download Agent, or to the Private ThreatCloud in a Single Box deployment. 2. Log in to Expert mode. 3. Restart the Private ThreatCloud services: ***\[Expert@HostName:0\]# ptc_stop ; ptc_start*** |

7. Installation from a USB does not allow any input > > |-------------------|------------------------------------------------------------------------------------------------------------------------------------------| > | Possible scenario | When using a bootable USB device and connecting using a USB-to-Serial converter, it is not possible to enter anything from the keyboard. | > | Solution | Use a computer that does not require a USB-to-Serial converter (that has a Serial / COM port built-in). |

8. IPS Scheduled Updates do not work * Scenario 1 |-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Possible scenario | You have configured IPS Scheduled Updates, but no updates are received. | | Possible cause | SmartDashboard remained open, and, by default, IPS does not receive updates while SmartDashboard is open. | | Solution | Either close the SmartDashboard, or go to the ***IPS*** tab - click on the ***Download Updates*** page - check the box ***Check for new updates while the SmartDashboard is active*** - click on the ***Save*** (press CTRL+S keys). | * Scenario 2 |-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Possible scenario | Security Management Server does not get the most recent IPS update, although the Private ThreatCloud is up to date (including IPS). | | Solution | 1. Connect with SmartDashboard to Security Management Server / Domain Management Server. 2. Go to the ***IPS*** tab - in the left tree, click on the ***Download Updates*** - click on the ***Scheduled Update...*** button. 3. In ***Advanced*** section: 1. Check the box ***On update failure perform*** - set the number to 5 retries. 2. Clear the box ***On Successful update perform Install Policy***. 3. Click on OK. 4. Save the changes: go to the ***File*** menu - click on the ***Save***. |

9. Bond interface on the Private ThreatCloud > > |-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Possible scenario | You have configured a Bond interface on the Private ThreatCloud. You are not able to configure the Security Gateways or other Check Point Devices to communicate with the Private ThreatCloud via this Bond interface. | > | Possible cause | The external IP address is missing from ***/etc/hosts*** file on the Security Gateways or other Check Point Devices. | > | Solution | On the Security Gateways or other Check Point Devices, add these entries to the ***/etc/hosts*** file with external IP address of your Private ThreatCloud: ***\ cws.checkpoint.com*** ***\ te.checkpoint.com*** ***\ updates.checkpoint.com*** ***\ secureupdates.checkpoint.com*** | > | Related solutions | * [sk110363 - Domain Name that was configured in First Time Configuration Wizard does not appear in the /etc/hosts file on Gaia OS](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110363) |

10. "*Upgrades (CPUSE) - Status and Actions* " page in Gaia Portal on Download Agent is stuck at "*Loading...*" > > |-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Possible scenario | Connect to Gaia Portal on Download Agent - go to the "*Upgrades (CPUSE)* " section - click on the "*Status and Actions* " page - it is stuck at "*Loading...* ". *Example* : [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk110972/Status_and_Actions.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk110972/Status_and_Actions.png "Click the image to see it in full size in a new tab/window") | > | Possible cause | The binary file ***cgisu*** has the wrong ownership / permissions. | > | Solution | 1. Set the required ownership and permissions for */usr/bin/cgisu* binary file: ***\[Expert@HostName\]# chown -v admin /usr/bin/cgisu*** ***\[Expert@HostName\]# chgrp -v config /usr/bin/cgisu*** ***\[Expert@HostName\]# chmod -v 4550 /usr/bin/cgisu*** **Note:** These commands survive reboot. 2. Verify the ownership and permissions: ***\[Expert@HostName\]# ls -l /usr/bin/cgisu*** Output should show: ***-r-sr-x---*** 1 ***admin config*** \ /usr/bin/cgisu | > | Related solutions | * [sk111167 - Some pages in Gaia Portal are stuck at "Loading...", or blank](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111167) |

11. Policy installation on Private ThreatCloud Gateway takes long time or fails > > |-------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Possible scenario | An entry with the host name and IP address of Private ThreatCloud Gateway is missing from the ***/etc/hosts*** file on the Private ThreatCloud Gateway. | > | Solution | Add the missing entry in the ***/etc/hosts*** file on the Private ThreatCloud Gateway. * Either in Gaia Portal: 1. Connect to Gaia Portal on the Private ThreatCloud Gateway: ***https://\*** 2. Go to the ***Network Management*** pane - click on the ***Hosts and DNS*** page 3. Scroll to ***Hosts*** section 4. The following entry should exist: ***\ \*** *Example* : [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk110972/Gaia_Portal_Hosts.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk110972/Gaia_Portal_Hosts.png "Click the image to see it in full size in a new tab/window") 5. If the above entry does not exist, then click on the ***Add*** button 6. In ***Host Name*** field, enter the *Host Name* of Private ThreatCloud Gateway (scroll up to the ***System Name*** section) 7. In the ***IPv4 Address*** field, enter the *IP Address* of the Private ThreatCloud Gateway 8. Click on OK. * Or in Gaia Clish: 1. Connect to the command line on the Private ThreatCloud. 2. Log in to Gaia Clish. 3. Check the current entries: ***HostName\> show host names*** The following entry should exist: ***\ \*** 4. If the above entry does not exist, then add it: 1. Get the current Host Name: ***HostName\> show hostname*** 2. Add the required entry: ***HostName\> add host name \ ipv4-address \*** 5. Save the Gaia Configuration: ***HostName\> save config*** 6. Verify: ***HostName\> show host names*** | > | Related solution | * [sk110363 - Domain Name that was configured in First Time Configuration Wizard does not appear in the /etc/hosts file on Gaia OS](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110363) |

12. "*Following a modification in your license information, the number of permitted cores has changed from unlimited to 1*" error while adding the Private ThreatCloud license > > |-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Possible scenario | "`Following a modification in your license information, the number of permitted cores has changed from unlimited to 1. This machine has a total of 8 cores.`" error when adding the Private ThreatCloud license. | > | Possible cause | The Security Gateway license is missing - you have just configured the Private ThreatCloud and that replaced the Plug-and-Play license provided with the appliance. | > | Solution | Add the license for the Security Gateway that is part of the Private ThreatCloud on the Private ThreatCloud itself (either in SmartUpdate, or on command line using the *cplic put* command). |

13. Security Gateway R77.20 and lower is not able to connect to Private ThreatCloud Appliance that is managed by R80.10 Management Server > > |-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Possible scenario | You are connecting Security Gateway R77.20 and lower to Private ThreatCloud that is managed by R80.10 Management Server. The output of `ptc_cli mgmt` command executed on the R80.10 Management Server shows the following: ``` Configuration failed to the following devices: Device |Error |Action ------------------------------------------------------------------------------ |General error |Contact Check Point Technical Support ``` *Example* : ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk110972/General_error.png) | > | Possible cause | R80.10 Management Server uses SHA-256 based certificates. However, the involved Security Gateway R77.20 and lower does not support SHA-256 based certificates. As a result, the `curl_cli` command called on the Security Gateway during the configuration fails with "`unknown message digest algorithm`" error. | > | Solution | Install the required Jumbo Hotfix Accumulator on the involved Security Gateway R77.20 and lower: * [Jumbo Hotfix Accumulator for R77.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101975) - *Take_77* and above * [Jumbo Hotfix Accumulator for R77.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98285) - *Take_127* and above * [Jumbo Hotfix Accumulator for R77](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk96192) - *Take_37* and above * [Jumbo Hotfix Accumulator for R76](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk96191) - *Take_61* and above * [Jumbo Hotfix Accumulator for R75.47](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk95827) - *Take_84* and above For details, refer to [sk103839 - Check Point update and online services migration to SHA-256 based certificates](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103839). |

14. "*Connection to source can not be established*" error when offline Security Gateways are trying to download Anti-Virus updates from Private ThreatCloud Appliance > > |-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Possible scenario | Security Gateways (that do not have an Internet connection) are trying to download Anti-Virus updates from Private ThreatCloud Appliance. The output of `ptc_cli monitor` command shows the following: ``` Update failed. checksum error for amw_kss_pkg.tar Update failed. Connection to source can not be established Update failed. Network operation timeout expired. Try again ``` The same Security Gateways are able to download Anti-Bot, IPS and Threat Emulation updates from the Private ThreatCloud Appliance. | > | Possible cause | Security Gateways are trying to connect to Check Point public ThreatCloud (*kav8.zonealarm.com* server). However, since these Security Gateways do not have an Internet connection, the update fails. | > | Solution | On each relevant Security Gateway, add a Host entry to resolve the *kav8.zonealarm.com* hostname to the IP address of the Private ThreatCloud Appliance. * In Gaia Portal: 1. Connect to Gaia Portal on the Private ThreatCloud Gateway: ***https://\*** 2. Go to the ***Network Management*** section. 3. Click on the ***Hosts and DNS*** page. 4. In the ***Hosts*** section, click on the ***Add*** button. 5. In the ***Host Name*** field, enter ***kav8.zonealarm.com*** 6. In the ***IPv4 Address*** field, enter the IP address of the Private ThreatCloud Appliance. 7. Click on OK. *Example* : [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk110972/Gaia_Portal_zonealarm.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk110972/Gaia_Portal_zonealarm.png "Click the image to see it in full size in a new tab/window") * In Gaia Clish: 1. Connect to the command line. 2. Log in to Gaia Clish. 3. Add the relevant host entry: ***HostName\> add host name kav8.zonealarm.com ipv4-address \*** 4. Save the Gaia Configuration: ***HostName\> save config*** 5. Verify: ***HostName\> show host names*** Note: To delete this entry, run: `HostName> delete host name kav8.zonealarm.com ipv4` ` HostName> save config` ` HostName> show host names` | > | Related solutions | * [sk83520 - How to verify that Security Gateway and/or Security Management Server can access Check Point servers?](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk83520) |

15. Engine Update is not the latest one > > |-----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Description | The engine version listed on 'ptc_cli monitor' command output is not updated to the last available version (for available engine versions, check [sk113332](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113332)). | > | Troubleshooting | On Private ThreatCloud appliance, check content of */opt/CPInstLog/install_ptc_engine.elg* . If no useful information can be seen in the log file, try to force engine update execution, as follows: 1. Connect to DB: *# mysql -u feedback -Dfeedback* 2. In *uploads_metadata* table, search for a file named - *engine_update_drop_X.tgz* (X is the latest package number): You should run the following sql command: *\> select \* from uploads_metadata where name like '%drop%';* 3. If the file is listed there, delete it as follows: *\> delete from uploads_metadata where name like '%drop%';* 4. At this stage, you will have to wait for a while. It will start with backing up the system (you can monitor it with *'ps aux \| grep backup'*) and once the backup is finished, the engine update process will start. 5. Once the engine update starts, you should see outputs in */opt/CPInstLog/install_ptc_engine.elg* in addition to */var/cptomcat-6.0.18/logs/ptcd.log*. Analyze the logs, and if unsuccessful, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) team responsible for Private ThreatCloud. |

16. Download Agent fails to download files behind SSL inspection > > |-----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Description | When installing Download Agent behind a gateway running SSL inspection (SSLi), the root certificate used for the SSLi should be trusted by the DA's JVM. | > | Troubleshooting | Save the root certificate in der format and copy it to the Download Agent (e.g. to $PTCDIR/jre/lib/security/my_ca.der) and run the following commands: * **[Expert@HostName:0]# keytool -importcert -alias startssl -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit -file $PTCDIR/jre/lib/security/my_ca.der**

* **[Expert@HostName:0]# keytool -importcert -alias startssl -keystore $PTCDIR/jre/lib/security/cacerts -storepass changeit -file $PTCDIR/jre/lib/security/my_ca.der**

* **[Expert@HostName:0]#**` ptc_stop; ptc_start` |

17. Gaia Portal shows blank page after login > |-----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Description | When connecting to https://\ and entering the admin credentials for the Gaia WebUI only a blank page appears | > | Troubleshooting | Follow up the manual procedure described in [sk121373 - Gaia Portal shows blank page after log in with Firefox 5x or Chrome 66](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk121373) (Do not install the Jumbo HF). |

18. Failed to configure PTC via Security Management R80.XX > |-----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Description | When configuring PTC via R80.XX Security Management server using 'ptc_cli mgmt', it fails with the error: "Failed to commit configuration". | > | Troubleshooting | As a workaround, configure the PTC using the 'ptc_cli config' script on the PTC server and once completed, again run the 'ptc_cli mgmt' script on the Security Management Server. |

19. Files identified as malicious by TE are not blocked by PTC > |----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Description | Files identified as malicious by TE are not blocked by PTC. | > | Possible cause | The request of the TE gateway is now directed to emulation.checkpoint.com instead of to te.checkpoint.com | > | Solution | Connect to the TE gateway and edit the *hosts* file using one of the following procedures: * **Via Gaia clish:** *\> add host name threat-emulation.checkpoint.com ipv4-address \ \> save config*
* **Via Gaia portal:** *Hosts and DNS tab \>\> Hosts\>\> Add Hostname: threat-emulation.checkpoint.com IP: \* |

20. Unable to open *report.html* > |----------------|------------------------------------------------------------------------------------------------------------------------------------| > | Description | In R80.20 PTC, unable to open *report.html* . The following error is received: "HTTP Status 500 - Unable to compile class for JSP" | > | Possible cause | Java version should run on Tomcat 7 | > | Solution | [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. |

21. Management client fails to connect to PTC\> > |----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Description | Management client fails to connect to PTC, connectivity errors can be found in */home/admin/ptc_mgmt_addon/log/offline_log/ptc_admin.log* on the management client. | > | Possible cause | | > | Solution | Make sure the WebUI port is set to 443. Make sure *httpd2* is up using the command *ps aux \| grep httpd2* |

22. Client is disconnected after R80.20 Jumbo installation > |----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Description | After installing R80.20 Jumbo on one of the PTC clients, the server appears as "disconnected" in *repor.html* and does not pull updates from the PTC. | > | Possible cause | The Jumbo installation removed the PTC certificate from *$FWDIR/bin/ca-bundle.crt* | > | Solution | Reconnect the client to the PTC: 1. Open SSH to the Management that manages the client. 2. Run *# ptc_cli mgmt* 3. Select "\[2\] Configure Security Gateways or other Check Point devices. 4. Select the PTC and follow the wizard. |

23. Timeout when downloading files after 30 seconds > |----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Description | Timeout when downloading files after 30 seconds. | > | Possible cause | Connectivity issue. | > | Solution | Starting Engine 13, you can Increase files download timeout using the configuration file: 1. On the Download Agent edit the file */usr/share/common/Properties/config.properties* 2. Add to the bottom of the file the following line where "X" stands for the required timeout: *simpleHttpDownloaderDC.readTimeoutInMillis=X* 3. Save the changes and restart the services using: *# ptc_stop;ptc_start*
**Note:** Default timeout is 30,000 millis -\> 0.5 min |

24. After mds_restore, 'ptc_cli mgmt' command is not recognized > |----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Description | After mds_restore, *ptc_cli mgmt* command is not recognized. | > | Possible cause | The *mds_backup* does not collect installed rpms. | > | Solution | Install the *ptc_mgmt_addon.rpm* on the MDS: 1. Download the file from: http://\/client_cli/ptc_mgmt_addon.rpm 2. Place the *ptc_mgmt_addon.rpm* on the MDS under */home/admin* and run the rpm: *# rpm -i ptc_mgmt_addon.rpm* |

25. Mysql logs consumes high amount of space > |----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Description | Mysql logs consumes high amount of space. | > | Possible cause | Binlog is enabled. | > | Solution | 1. Disable extended logs for binlog (add "#"): *# vi /opt/CPtms/cur/mariadb/my.cnf* From: ``` log_bin = /usr/local/mysql/binlog/mysql-bin relay_log = /usr/local/mysql/binlog/mysql-relay expire_logs_days = 10 max_binlog_size = 100M binlog_format = ROW ``` To: ``` #log_bin = /usr/local/mysql/binlog/mysql-bin #relay_log = /usr/local/mysql/binlog/mysql-relay #expire_logs_days = 10 #max_binlog_size = 100M #binlog_format = ROW ``` 2. Delete logs: *# rm /var/log/versions/\*/mariadb/mysql/binlog/mysql-bin.0\** 3. Restart services: *# ptc_stop;ptc_start* |

26. Missing packages on PTC or other malfunctioning of the ptcd process > |----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Description | Missing packages on PTC or other malfunctioning of the *ptcd* process. | > | Possible cause | Memory problem of the *ptcd* process. To make sure, check for errors in *ptcd.log* . You should see the following error: "Java heap space" To check the current memory limit for the process, run: *ps -ef \| grep instance04* In the *instance04* process line, check the -*Xmx* param. It would probably be "-*Xmx1G*" or "-Xmx2G". | > | Solution | **Increase the *ptcd* process memory.** **On the PTC:** 1. Check which tomcat version you have by running: *echo $CATALINA_HOME /var/cptomcat-6.0.18 - tomcat6 /var/tomcat7_0_37/ - tomcat 7* 2. Edit the tomcat configuration file: **tomcat 6:** 1. Backup *$CATALINA_HOME/bin/catalina.sh* 2. Find the line where *JAVA_OPTS* is defined: *JAVA_OPTS="-Xms1G --Xmx2G -XX:MaxPermSize=512M -Dcom.sun.management.jmxremote -Duser.language=en -Duser.country=US -Duser.region="* 3. Change *--Xmx2G* (or *--Xmx1G* ) to *--Xmx3G* **tomcat 7:** 1. Backup */var/tomcat7_instances/instance04/bin/setenv.sh* 2. Find this line: *CATALINA_OPTS="$CATALINA_OPTS -Xms1G -Xmx2G -XX:MaxPermSize=512M -Dspring.profiles.active=ptc -Dext.prop.dir=/usr/share/common/Properties/ -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2"* 3. Change *--Xmx2G* to *--Xmx3G* 3. Run: *ptc_stop;ptc_start* 4. Run "*ps -ef \| grep instance04* " again, and check that the -*Xmx* param is now "*-Xmx3G*" to make sure that the configuration took effect. |

27. Errors when adding a new Single Box Private ThreatCloud appliance on the Management Server > > |-------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Possible scenario | * The "`pct_cli mgmt`" command fails with this error (see [sk149692](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk149692) \> Installation \> Initial Configuration \> SingleBox Configuration: `===============================================================` ` Private ThreatCloud Management Add-On` ` ===============================================================` ` `*Failed to configure host: X.X.X.X, verify installation and retry* Where "X.X.X.X" is the IP address of the Management Interface on the Smart-1 Private ThreatCloud Appliance * The "`ptc_cli config`" command fails with this error: `====================================================================` ` Certificate Creation` ` ===============================================================` ` You must establish trust between the Private ThreatCloud and the Security Gateways or other Check Point Devices that use it.` ` To establish this trust, a certificate must be installed on this Private ThreatCloud.` ` Fetching the certificate from the Private ThreatCloud...` ` `*Internal Error, check log file* | > | Root Cause | An administrator changed the Platform Portal configuration in the Private ThreatCloud object from the default port 443 to another port number. | > | Solution | Change the Platform Portal configuration in the Private ThreatCloud object to use the default port 443: 1. Connect with SmartConsole to the Private ThreatCloud appliance. 2. From the left navigation panel, click **Gateways \& Servers**. 3. Double-click the Private ThreatCloud object. 4. From the left tree, click "***Platform Portal***". 5. In the "***Main URL***" field, after the IP address / URL, remove the port number. 6. Click **OK**. 7. In the top left corner, click **Menu** \> **Install database**. 8. Select the Private ThreatCloud object object. 9. Click **Install**. |

--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content