> Source: [sk155113](https://support.checkpoint.com/results/sk/sk155113) # sk155113 - Indexes are not created for Firewall and VPN blade | Property | Value | |----------|-------| | Solution ID | sk155113 | | Date Created | 2019-06-02 | | Last Modified | 2023-04-25 | | Technical Level | General | | Products | Security Management Server, Multi-Domain Security Management Server | | Versions | R82.10, R82, R81.20, R82.10, R82.20, R81.20, R82, R82.20 | | OS | Gaia | ## Symptoms - * Indexes are not created for Firewall and VPN blade for gateways that logging to this specific machine, while non-indexed logs look fine - all blades all gateways are visible. * The `indexer.elg` file shows: ` [DATE] msg: SolrCore 'firewallandvpn_`' is not available due to init failure: Could not load core configuration for core firewallandvpn_ [DATE] trace: org.apache.solr.common.SolrException: SolrCore 'firewallandvpn_' is not available due to init failure: Could not load core configuration for core firewallandvpn_ SolrException: Error loading solr config from /opt/CPrt-R80/rfl_server/solr/configsets/firewallandvpn/solrconfig.xml [DATE] SolrClient::Implementation::ParseJavaBinReply Bad Java bin format [DATE] RFLIndexDoer::sendToSolr: Send error occurred(19,19). Tried 2 out of max 2 [DATE] RFLIndexDoer::Partial_Buf_Process: The following log is not accepted by solr (file = @A@@B@1556689950 position = 16579102) : Caused by: org.apache.solr.common.SolrException: Error loading solr config from /opt/CPrt-R80/rfl_server/solr/configsets/firewallandvpn/solrconfig.xml at org.apache.solr.core.SolrConfig.readFromResourceLoader(SolrConfig.java:148) at org.apache.solr.core.ConfigSetService.createSolrConfig(ConfigSetService.java:79) at org.apache.solr.core.ConfigSetService.getConfig(ConfigSetService.java:61) ... 49 more **Caused by: org.apache.solr.common.SolrException: Value of 'maxMergeCount' can not be parsed as 'int': "2.5"** at org.apache.solr.util.DOMUtil.addToNamedList(DOMUtil.java:167) at org.apache.solr.util.DOMUtil.nodesToNamedList(DOMUtil.java:106) at org.apache.solr.util.DOMUtil.childNodesToNamedList(DOMUtil.java:96) at org.apache.solr.core.PluginInfo.< init >(PluginInfo.java:52) at org.apache.solr.core.SolrConfig.readPluginInfos(SolrConfig.java:345) at org.apache.solr.update.SolrIndexConfig.getPluginInfo(SolrIndexConfig.java:197) ... * If manually replacing the `solrconfig.xml` file from `/opt/CPrt-R80/rfl_server/solr/configsets/firewallandvpn/conf/` to `/opt/CPrt-R80/rfl_server/solr/configsets/firewallandvpn/` And restart the Indexer with `evstop;evstart`: * New FirewallAndVpn folder is recognized under the log_indexes for the current date * New indexed logs are visible in SmartConsole, but refreshing the view shows the logs time lagging from the current time and soon the indexer process will stop to create a new indexes.
* No `FirewallAndVpn` folder under the `log_indexes` directory. ## Cause 1. The exception seen in the log_indexer.elg and solr.log files point to a Integer parsing error: *Caused by: org.apache.solr.common.SolrException: Value of 'maxMergeCount' can not be parsed as 'int': "2.5"* This seems to start the chain of exceptions that leads the SOLR to look for the solrconfig.xml at a wrong place. 2. The *maxMergeCount* is a variable that hold the number of threads used for merging the SOLR core segments. SOLR code expects this variable to be an integer, when the value is a float number the exception is caused. The value of maxMergeCount is read from the file *$FWDIR/conf/serverSettings.props* . In this case the value is 2.5 - *RFL_SOLR_MAX_MERGE_COUNT=2.5*
3. The default value is in the solrconfig.xml file, that value gets override with the value in -$CPDIR/conf/CpSetupInfo_resourceProfiles.conf according to the specific machine profile. For example: *:complex_expression (* *:name (RFL_SOLR_MAX_MERGE_COUNT)* *:type (numeric)* *:default (2)* *:condition_exp ("CPU_NUMBER == 2")* *:false_exp ("2 MAX CPU_NUMBER / 2")* *:true_exp (2)* *)* ## Solution 1. Check the amount of the CPU cores in this machine. Probably the server was initially created (in case of virtual environment) or reconfigured with odd CPU core numbers - for example 5 cores. 2. Edit the amount of CPU cores to be even (or exponent 2\^x) 3. Reboot the machine. The value will be automatically updated and the indexer will start create a new indexes files. No need to edit any files manually. 4. This problem was fixed. The fix is included in: * [**Check Point R80.20**](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122485) * **[Jumbo Hotfix Accumulator for R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380) starting from Take 288** Check Point recommends to always upgrade to the [most recent version](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166715). For earlier versions, please[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix that enables change of the profiles files to handle odd number of CPUs. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content