> Source: [sk113955](https://support.checkpoint.com/results/sk/sk113955) # sk113955 - "You have reached the maximum number of active sessions" error in SmartConsole | Property | Value | |----------|-------| | Solution ID | sk113955 | | Date Created | 2016-10-27 | | Last Modified | 2025-11-18 | | Technical Level | General | | Products | Security Management Server, SmartConsole, Multi-Domain Security Management Server | | Versions | R82.10, R82, R81.20, R82.10, R82.10, R81.10 (EOS), R81 (EOS), R82, R81.20, R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82 | | OS | Gaia | ## Symptoms - * "`You have reached the maximum number of active sessions`" error when trying to connect to Security Management Server / Domain Management Server with SmartConsole, `mgmt_cli` utility, or Management APIs. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113955/Login_exception1610270510.png) * "`Unable to connect to server`" error in SmartConsole (R80 and higher): ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113955/Unable_to_connect_to_server1611130401.PNG) * The `$MDS_FWDIR/log/cpm.elg` file on the Management Server (R80 and higher) contains the following line: `All ID's for ObjectStoreSessionEntity occupied` ## Cause The number of active sessions is restricted to 100 sessions per administrator and domain. An active session is a session that was not published and was not discarded. Typically, this happens when using a script that runs Management API commands to log in and fails to call the applicable Management API commands "publish" or "discard" at the end of the script. ## Solution To recover from this error and be able to log in again, remove some of your active sessions in ***one*** of these two ways: * ### Either using the SmartConsole GUI 1. Log in to SmartConsole with another administrator username. This administrator should have the permission to "Manage Sessions" (typically, a super-admin). 2. On the left Navigation Toolbar, click ***MANAGE \& SETTINGS***. 3. In the upper pane, expand the ***Sessions*** menu and click ***View Sessions***. 4. Discard or publish some of the sessions for the administrator who fails to log in. * ### Or using a special shell script This shell script will remove all WEB API sessions that were created using either the `mgmt_cli` tool or the Management APIs. Note: If one of the sessions has unpublished changes in it, that session will *not* be deleted. 1. Download [this TAR archive](https://support.checkpoint.com/results/download/57375) with the required shell script to your computer. 2. Transfer the downloaded TAR archive from your computer to the Security Management Server / Multi-Domain Management Server (into some directory, e.g., */some_path_to_fix/*). 3. Connect to the command line on the Security Management Server / Multi-Domain Management Server. 4. Log in to the Expert mode. 5. Extract the required files from the TAR archive: `[Expert@Mgmt:0]# cd /some_path_to_fix/` `[Expert@Mgmt:0]# tar -xvf sk113955.tar` 6. Assign the required permissions to the shell script: `[Expert@Mgmt:0]# chmod -v a+x /some_path_to_fix/discard_web_api_no_changes.sh` 7. Just in case, convert the shell script from DOS format to UNIX format: `[Expert@Mgmt:0]# dos2unix /some_path_to_fix/discard_web_api_no_changes.sh` 8. Check whether Check Point services are up and running: * On a Security Management Server: `[Expert@Mgmt:0]# cpwd_admin list` Note: Output should show "`E`" (executing) in the "`STAT`" column. * On a Multi-Domain Security Management Server: `[Expert@Mgmt:0]# mdsstat` If the services are down, then start them: * On a Security Management Server: `[Expert@Mgmt:0]# cpstart` * On a Multi-Domain Management Server: `[Expert@Mgmt:0]# mdsstart` 9. If the problem occurred on a *Domain Management Server* , in which you have reached the maximum number of active sessions, then follow these steps (***before*** executing the shell script): 1. Connect with SmartConsole to the Domain Management Server on the Multi-Domain Management Server. 2. On the left Navigation Toolbar, click ***MANAGE \& SETTINGS***. 3. In the upper pane, expand the ***Sessions*** menu and click ***View Sessions***. 4. Look at the ***Administrator*** column. 5. Discard and Disconnect the session, whose "Administrator" is ***WEB_API***: One of the following options can be available in the SmartConsole (depending on the version): * Either: 1. Right-click the "WEB_API" session and then click the ***Discard \& Disconnect*** option. 2. Click ***Yes*** to confirm. * Or: 1. Right-click the "WEB_API" session and then click the ***Discard*** option. 2. Right-click the "WEB_API" session and then click the ***Disconnect*** option. 3. Click ***Yes*** to confirm. 6. Close the SmartConsole. 10. Execute the shell script: `[Expert@Mgmt:0]# ./some_path_to_fix/discard_web_api_no_changes.sh` *Example:* > > ``` > Going to discard 5 web_api worksessions. > About to discard worksession: 88a308de-8b97-43a7-bcd0-52905faf1225 > message: "OK" > number-of-discarded-changes: 0 > > About to discard worksession: b31f50a8-ea8d-4008-98c7-84f0e3dcf6bf > message: "OK" > number-of-discarded-changes: 0 > > About to discard worksession: c76bbcb5-231f-49d9-bb63-d5146b5901ea > message: "OK" > number-of-discarded-changes: 0 > > About to discard worksession: 90eca66b-3195-4508-8d4a-7887161eaf7f > message: "OK" > number-of-discarded-changes: 0 > > About to discard worksession: 5afc638e-ba04-4700-bf2a-483d00a4c9a3 > message: "OK" > number-of-discarded-changes: 0 > > message: "OK" > number-of-discarded-changes: 0 > > message: "OK" > > Finished. > Note: List of WEB_API worksessions that were closed: api_sessions.txt > ``` **Warnings** * While running the *discard_web_api_no_changes.sh* script, the following messages may appear: ``` [Expert@Mgmt:0]# ./discard_web_api_no_changes.sh Going to discard 2353 web_api worksessions. Error: Failed to login to the management server ``` This happens because *WEB_API* reached maximum allowed connections, and therefore the Management Server prohibits any additional attempt to log in. The following workaround is available: Edit the *discard_web_api_no_changes.sh* script in Vi editor and change the "login" line from: `mgmt_cli login -r true < id.txt;` to: `mgmt_cli login `user password ` > id.txt;` * If in the Management Server object you configured Gaia Portal (Multi-Portal) to use a port other than the default 443, then while running the *discard_web_api_no_changes.sh* script, the following message may appear: ``` [Expert@Mgmt:0]# ./discard_web_api_no_changes.sh Going to discard 17 web_api worksessions. ``` Edit the *discard_web_api_no_changes.sh* script in Vi editor and change the "login" line from: `mgmt_cli login -r true > id.txt;` to (example is for the port 4434): `mgmt_cli login `--port 4434` -r true > id.txt;` ### Related Documentation * Security Management Server Administration Guide for your version. * Multi-Domain Management Administration Guide for your version. * [Management API Reference](https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction). **Related Solution:** * [sk120993 - "getting domain name failed" error when running "vsec_config" command on vSEC Controller](https://support.checkpoint.com/results/sk/sk120993) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content