> Source: [sk170331](https://support.checkpoint.com/results/sk/sk170331)

# sk170331 - Security Gateway stops logging locally or to assigned Log Servers

| Property | Value |
|----------|-------|
| Solution ID | sk170331 |
| Date Created | 2020-11-04 |
| Last Modified | 2025-01-20 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Security Gateway / Cluster Member stops logging locally or to configured Log Servers.

* "`FwKluProcessLogEx: fail to convert klog buffer to unified fragment`" line appears repeatedly in the `$FWDIR/log/fwd.elg` log file on a Security Gateway / Cluster Member.

## Cause

The file *fw.logtrack* file on Security Gateway / Cluster Member is corrupted. This may be caused by extremely high load on the FWD daemon.

## Solution

**Critical:** You must schedule a maintenance window to perform this procedure. Because this procedure stops the FWD daemon, it may cause a traffic outage, and a failover in a cluster.

1. Connect to the command line on the Security Gateway / Cluster Member.
2. Log in to the Expert mode
3. Terminate the FWD daemon:  
   `cpwd_admin stop -name FWD -path "$FWDIR/bin/fw" -command "fw kill fwd"`
4. Delete the corrupted *fw.logtrack* file:  
   `rm -i $FWDIR/log/fw.logtrack`
5. Start the FWD daemon:  
   `cpwd_admin start -name FWD -path "$FWDIR/bin/fw" -command "fwd"`
6. Examine the local logging - the sizes of the local log files must change:  
   `watch -d -n 1 "ls -l $FWDIR/log/fw.log*"`
7. Examine the remote logging - SmartConsole must show logs from this Security Gateway / Cluster Member.

<br />

This problem was fixed. The fix is included in:

* [Check Point Quantum R82](https://support.checkpoint.com/results/sk/sk181127)
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 54
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 141
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 99
* [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 211

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

**Part 1 - Delete the corrupted *fw.logtrack* file:**
**Critical:** You must schedule a maintenance window to perform this procedure. Because this procedure stops the FWD daemon, it may cause a traffic outage, and a failover in a cluster.

1. Connect to the command line on the Security Gateway / Cluster Member.
2. Log in to the Expert mode
3. Terminate the FWD daemon:  
   `cpwd_admin stop -name FWD -path "$FWDIR/bin/fw" -command "fw kill fwd"`
4. Delete the corrupted *fw.logtrack* file:  
   `rm -i $FWDIR/log/fw.logtrack`
5. Start the FWD daemon:  
   `cpwd_admin start -name FWD -path "$FWDIR/bin/fw" -command "fwd"`
6. Examine the local logging - the sizes of the local log files must change:  
   `watch -d -n 1 "ls -l $FWDIR/log/fw.log*"`
7. Examine the remote logging - SmartConsole must show logs from this Security Gateway / Cluster Member.
8. If the issue persists, continue to Part 2.

**Part 2 - Configure an environment variable:**

1. Connect to the command line on the Security Gateway / **each** Cluster Member.
2. Log in to the Expert mode
3. Back up the current *$CPDIR/tmp/.CPprofile.sh* file:  
   `cp -v $CPDIR/tmp/.CPprofile.sh{,_BKP}`
4. Edit the current *$CPDIR/tmp/.CPprofile.sh* file:  
   `vi $CPDIR/tmp/.CPprofile.sh`
5. Add this line - somewhere between the existing environment variables, and not at the end of the file:  
   `KLOG_CONVERTER_ENV_VAR=800; export KLOG_CONVERTER_ENV_VAR ; hash 1>/dev/null 2>&1`
6. Save the changes in the file and exit Vi editor.
7. Reboot the Security Gateway / each Cluster Member.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content