> Source: [sk117012](https://support.checkpoint.com/results/sk/sk117012) # sk117012 - "NGM failed to import data" or "NGM failed retrieve last publish time" errors | Property | Value | |----------|-------| | Solution ID | sk117012 | | Date Created | 2017-04-21 | | Last Modified | 2024-06-15 | | Technical Level | General | | Products | Security Management Server, Multi-Domain Security Management Server | | Versions | R81.20, R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20 | | OS | Gaia | ## Solution This article describes scenarios when these errors appear during Management HA Synchronization: * *NGM failed to import data* * *NGM failed retrieve last publish time* **Important Note** : Before you make changes to the database, [contact Check Point support](https://www.checkpoint.com/support-services/contact-support/) for a verification. Show the Entire Article ### **Scenario 1 - Multi-Domain Management (or Security Management) Server Synchronization Failure - "\[Peer Name\] NGM failed to import data" error** Show / Hide this section **Symptoms:** * Multi-Domain Management (or Security Management) full synchronization fails with this error: `Full sync with peer '[Peer Name]' NGM failed to import data` * The *$FWDIR/log/cpm.elg* file on the Management Server contains one of these lines: * `AssertionError has been caught: There are invalid assignments on peer` * `ERROR coresvc.internal.WorkSessionMgmtSvcImpl [XXX]: Tried to get a non existing session , Couldn't find it in database` * The "Global domain assignment check" test in the CPM Doctor report shows the "`ERROR`" status. * SmartConsole crashes when loading one or more policies. * Application Control and IPS fail to update the signatures. * "*Failed to get DB object.*" error when opening Application Control update or IPS update in SmartConsole. **Cause**: Insufficient disk space on the secondary Multi-Domain Management server. **Solution:** Do one of these steps: * Clear disk space on the secondary Multi-Domain server. Or * Reboot the primary Multi-Domain Management server. This problem was fixed. The fix is included starting in: * [Check Point R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166715) * [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) - from Take 38 * [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) - from Take 195 * [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) - from Take 160 * [Jumbo Hotfix Accumulator for R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380) - from Take 278 If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case. ### Scenario 2 - Management High Availability sync fails with the "NGM failed to import data" error Show / Hide this section **Symptoms:** * Management High Availability sync fails with the "*NGM failed to import data* " error. * Debug of the CPM process shows: `"ERROR infrastructure.logging.DefaultExceptionLoggerHandlerImpl [XXX]: incident XXX]:` `java.nio.file.FileSystemException: /opt/CPsuite-R80.40/fw1/tmp/XXX: Too many links"` **Cause** The temporary directories in */opt/CPsuite-\/fw1/tmp/* were not deleted. As a result, the Linux limitation of 32000 files and directories was exceeded. These directories are created by the internal "cp_postgres" user and their names are UUID values. These directories are normally removed at the end of each sync. **Solution** This problem was fixed. The fix is included starting from: * [Jumbo Hotfix Accumulator for R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114) starting from Take 13 * [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 91 * [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 228 * [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) starting from Take 190 * [Jumbo Hotfix Accumulator for R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380) starting from Take 288 ### Scenario 3 - R80.x Management HA Full Sync takes too long Show / Hide this section **Symptoms:** * HA Full sync does not respond for more than one hour with "*NGM failed to import data* ". * HA Full sync fails with "*Archiving operation failed* ". * HA Full sync fails with "*Communication has been aborted by the pee*r". **Cause** : * There is an indexing issue in the *abstractauditlogbase* table. * The size of *abstractauditlogbase* is more than 10GB, and the size of the audit log from the IPS domain takes up more than 80% of the table's size. **Solution:** **\*\*For R80 base only:** **Note** :Contact Check Point support for a verification before you make changes to the database. 1. Fix the indexing issue in the *abstractauditlogbase* table: * `#psql_client cpm postgres` * `> BEGIN;` * `> DROP INDEX IF EXISTS abstractauditlogbase_mach_dom_synctransactionid_idx;` * `> CREATE INDEX abstractauditlogbase_mach_dom_synctransactionid_idx ON abstractauditlogbase (machine, domainid, transactionid, synctransactionid, publicsession);` * `> END;` * `> \q` 2. Run these commands from postgres: `\d abstractauditlogbase ` At the end of the "Indexes" section, you should see: `"abstractauditlogbase_mach_dom_synctransactionid_idx" btree (machine, domainid, transactionid, synctransactionid, publicsession)` 1. If indexing by `transactionid` field is missing: * Size of the whole abstractauditlogbase: select sum(octet_length(al.\*::text)) from abstractauditlogbase al; * Size of audit log from the IPS domain: select sum(octet_length(al.\*::text)) from abstractauditlogbase al where domainid = 'a0bbbc99-adef-4ef8-bb6d-cebcebcebceb'; * **[R80IpsDomainFilesCleanup.groovy](https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=59508)** - for a pre-R80 Jumbo take 76 version * **[R80IpsDomainFilesCleanupAboveR80JumboT76.groovy](https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=59511)** - for R80 Jumbo take 76 and above. 2. If the size of abstractauditlogbase is more than 10GB and the size of the audit log from the IPS domain takes up more than 80% of whole table's size, run this script: Copy the script into *$MDS_FWDIR/scripts*directory `#$MDS_FWDIR/scripts/run_groovy_script.sh $MDS_FWDIR/scripts/R80IpsDomainFilesCleanup.groovy` 3. Make sure there are no more audit logs: `cpm=# select count(*) from abstractauditlogbase where domainid = 'a0bbbc99-adef-4ef8-bb6d-cebcebcebceb';` Output example: `count` ` -------` ` 0` **\*\*For R80.10 only**: 1. Check the size of the audit logs and files: **Note** : the returned values should be in bytes. Size of IPS Audit logs: `# psql_client cpm postgres -c "select sum(octet_length(al.*::text)) from abstractauditlogbase al where domainid = 'a0bbbc99-adef-4ef8-bb6d-cebcebcebceb';"` `# psql_client cpm postgres -c "select sum(pg_column_size(abstractauditlogbase.*)) FROM abstractauditlogbase where domainid='a0bbbc99-adef-4ef8-bb6d-cebcebcebceb';"` Size of IPS files: `# psql_client cpm postgres -c "select sum(length(lo.data)) from pg_largeobject lo where lo.loid in (select largeobjoid from internalfile where domainid='a0bbbc99-adef-4ef8-bb6d-cebcebcebceb');"` 2. If the audit logs size is larger than 0.5GB or the files size is larger than 2GB, download these files: *IpsDomainFilesCleanup.groovy* and *IpsDomainAuditLogsAndDerefCleanup.txt* and transfer them to the Primary Management Server (contact Check Point Support to get the files). 3. Copy the groovy script and txt file into*/home/admin* directory and run: `# $MDS_FWDIR/scripts/run_groovy_script.sh /home/admin/IpsDomainFilesCleanup.groovy` 4. Run the *.txt* file: `# psql_client cpm postgres -f /home/admin/IpsDomainAuditLogsAndDerefCleanup.t`xt 5. Check the size of the IPS audit logs and files by running the commands from step 1 or CPM Doctor. ### Scenario 4 - Multi-Domain Management HA synchronization fails Show / Hide this section **Symptoms** * Multi-Domain Management Servers HA sync fail with SmartConsole error: "*Failed to synchronize peer - NGM failed to import data* " * The output of this command shows that the overall disk space of the AbstractAuditLogBase table is over 10GB: `[Expert@MGMT:0]# psql_client cpm postgres -c "select sum(octet_length(al.*::text)) from abstractauditlogbase al ;"` * This procedure shows that the overall disk space in abstractauditlogbase table for each domain is over 1GB: 1. Get the list of domain IDs: `[Expert@MGMT:0]# psql_client cpm postgres -c "select name,objid from domainbase_data;"` 2. Check the overall disk space in the abstractauditlogbase table for each domain by running this command for each 'objid' value obtained in the previous step: `[Expert@MGMT:0]# psql_client cpm postgres -c "select sum(octet_length(al.*::text)) from abstractauditlogbase al where domainid = '';"` **Cause** : Too many revisions on each domain which are created every time a publish operation is performed in SmartConsole. **Solution:** Purge old revisions (older than X months as per company's policy) to reduce the size of the abstractauditlogbase table on each domain. 1. Launch SmartConsole 2. Go to **Manage \& Settings** \> **Revisions**. 3. Right-click the newest revision to be removed and select **Purge**. You will get the following warning: *All data from the selected revision and prior to it will be permanently deleted. You will not be able to revert this operation!* 4. Make sure everything is correct before clicking **Yes**.
### Scenario 5 - Unable to Sync Domain Management in Multi-Domain Management server HA Show / Hide this section **Symptoms:** * Sync fails with error: *NGM failed to import data for domain* * Sync on Domain Management Servers fails with error*: Master peer failed to synchronize me - NGM failed to import data* * The *cpm.elg*file shows this error: AssertionError has been caught: failed loading data of incremental sync! * Sync from Primary DMS (active) to the Secondary DMS (standby) fails, while the reverse direction is successful. * In the debug the error is: `ERROR ha.fwm_handlers.AsyncFwmCallHandlerBase [SYNC_THREAD_388085]: peerId a8342d0d-8a95-4394-81cf-bba7b1747fcd operation MANUAL_SYNC with opId 21461b0c-d67a-48b0-ae9a-5e99bb618ede failed: - NGM failed to import data for domain edf7edd0-22ad-4f41-9c1e-c9244dfcaf8e ` **Cause** : Policy is not synchronized at the global level. **Solution:** Do a full sync at the global level: 1. Open Global SmartConsole \> Management High Availability \> Sync Peer (for the applicable Secondary MDS). 2. When complete, the sync at the domain level will be successful automatically. ### Scenario 6 - Sync fails with"NGM failed retrieve last publish time" error in cpm.elg Show / Hide this section **Note** : Recently, this error message was changed in JHFs to "*NGM failed to retrieve the last published time* ". **Symptoms** : * After upgrade, Full HA sync fails with "NGM failed retrieve last publish time" error in logs. * *fwm.elg* file on the Primary management server shows: `[FWM PID]@MDS[DATE TIME] Object sent to slave: ` `[FWM PID]@MDS[DATE TIME] CBinResponse::ReadFromBuffer: result code failed1-2147214215` `[FWM PID]@MDS[DATE TIME] CResultHolder::SetResult() result code failed: 1-2147214215 `**NGM failed retrieve last publish time** `[FWM PID]@MDS[DATE TIME] Object received from slave: ` * fwm.elg file on the Secondary management server shows: `[FWM PID]@SecMDS[DATE TIME] CNgmJournal::updateSeqVector Sending getHaStatus request to NGM. opId = 7e9182bf-cd22-4564-b060-f250465ef30e` `[FWM PID]@SecMDS[DATE TIME] CNgmJournal::updateSeqVector getLastPublishTime failed` * *cpm.elg*file on the primary management server shows: `DATE TIME,PID INFO dleserver.internal.MgmtHaSvcRemoteImpl [qtp1779356392-61117]: PeerSyncStatus{masterPeerId=null, peerId=7e7a7f52-79a3-4136-a876-8629e645c109, syncOperation=MANUAL_SYNC, syncOpResult=SYNC_ERROR, dbName='NGM', errorMsg=' - `**NGM failed retrieve last publish time** `', `**validationResults=null**`}` `DATE TIME,PID INFO internal.ha.MgmtHaSvcImpl [qtp1779356392-61117]: async peer result for opId 7e9182bf-cd22-4564-b060-f250465ef30e peer 7e7a7f52-79a3-4136-a876-8629e645c109: MANUAL_SYNC, SYNC_ERROR, - `**NGM failed retrieve last publish time, null for domain name 'Internet'**` , id [59b18263-0175-4777-8f7e-0fa3114b33bd]` * *cpm.elg* file on the Secondary management server shows: `DATE TIME,PID ERROR utils.runtime.CpAssert$DefaultAssertionErrorHandler [qtp-57307152-28123]: `**AssertionError has been caught: no peer status found for peer**` d37a523a-ede5-11d7-9478-cc94ec097070` `DATE TIME,PID ERROR infrastructure.logging.DefaultExceptionLoggerHandlerImpl [qtp-57307152-28123]: incident [b5987f59-e1c9-4868-af48-1a9ea5c347c1]:` `com.checkpoint.infrastructure.utils.runtime.`**CpAssertionError: no peer status found for peer**` d37a523a-ede5-11d7-9478-cc94ec097070` **Cause** : Database inconsistency during upgrade or incorrect registry value. **Solution** : Do these steps: 1. If this is a Multi-Domain Management, mdsenv into the CMA: `[Expert@HostName]# mdsenv ` 2. Back up the registry file: `[Expert@HostName]# cp -pv $CPDIR/registry/HKLM_registry.data $CPDIR/registry/HKLM_registry.data_ORIGINAL` 3. Check the NeverSynced value on the Secondary Management Server: `[Expert@HostName]# $CPDIR/bin/cpprod_util CPPROD_GetValue FW1 NeverSynced 1` 4. If the value is 1, set it to 0: `[Expert@HostName]# $CPDIR/bin/cpprod_util CPPROD_SetValue FW1 NeverSynced 4 0 1` 5. Perform a full sync in SmartConsole. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content