> Source: [sk116117](https://support.checkpoint.com/results/sk/sk116117)

# sk116117 - Indexer process is crashing causing the logs to be empty

| Property | Value |
|----------|-------|
| Solution ID | sk116117 |
| Date Created | 2017-02-27 |
| Last Modified | 2021-07-25 |
| Technical Level | General |
| Products | Security Management Server, Multi-Domain Security Management Server, Logging & Status |
| Versions | R81 (EOS), R81 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Indexer process crashes causing the logs to be empty.  

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1488199372328/emptylogs1702270451.png)  

* When running a query, the following error is received: `"Query resolution failed. Logs might not display properly. Try again later."`  

* The `$INDEXERDIR/log/log_indexer.elg` file shows:  
  log_indexer.elg.x-\[DATE TIME\] CBinaryLogFile::ReplaceFileToMemStringID: error - can't get mem string id  

* Following logs are shown in the `$INDEXERDIR/log/log_indexer.elg` file :  
  LogFetcherFiles::FileReadSession: failed to read from .log position 2170572 CBinaryLogFile::ReadLog: error can"t find Interface Name string id, will set to NULL (default)  

* FWD and CPCA processes of Security Management are down. FWD process constantly tries to restart and crashes with the core.

## Cause

Corruption in a specific log file.

## Solution

This problem was fixed. The fix is included in:

* [R81.10 and higher](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170416 "Check Point R81.10")
* [Jumbo Hotfix Accumulator for R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114) starting from Take 13
* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 91
* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 228
* [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) starting from Take 190
* [Jumbo Hotfix Accumulator for R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380) starting from Take 288

<br />

If you choose not to upgrade, the following workaround is available:

1. Open the `$INDEXERDIR/log/log_indexer.elg` file and locate the line: `"ReplaceFileToMemStringID: error - can't get mem string id"`  

2. Check the log file name above this file, for example:   

   `[log_indexer PID]@NAME[DATE TIME] Start reading 127.0.0.1:`**2017-02-01_091119.log** `[1485858764] at position 5241860`  

   `log_indexer.elg.7-[DATE TIME] CBinaryLogFile::ReplaceFileToMemStringID: error - can't get mem string id`

<!-- -->

This means that the Indexer is stuck on 2017-02-01_091119.log.

<br />

<br />

**After Identifying the log**, perform the following steps on the LogServer machine:

1. Run: `# evstop`
2. Run: `# cd $INDEXERDIR/data`
3. Backup the file: `# cp FetchedFiles /var/tmp`
4. Edit the file in VI editor.
5. Go to the log line and change the fifth column from 0 to 1   

   Example:  

   from: ...

   `127.0.0.1 21 2017-02-01_091119.log 1485858764 0.`
   to: ....  

   `127.0.0.1 21 2017-02-01_091119.log 1485858764 1.`
6. Run: `# evstart`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content