> Source: [sk173328](https://support.checkpoint.com/results/sk/sk173328)

# sk173328 - Reports Constantly Refresh in Logs and Monitor

| Property | Value |
|----------|-------|
| Solution ID | sk173328 |
| Date Created | 2021-05-05 |
| Last Modified | 2021-05-13 |
| Technical Level | Advanced |
| Products | SmartConsole |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Reports in Logs and Monitor refresh as soon as they are loaded.

* /var/log/messages show multiple clish commands run;  

  `[DATE TIME] mgmt-server clish[534]: User admin running clish -c with ReadWrite permission`  
  `
  [DATE TIME] mgmt-server clish[534]: cmd by admin: Start executing : show web ... (cmd md5: b1b5f52fb19539d353d42d9a9c331f5e)`  
  `
  [DATE TIME] mgmt-server clish[534]: cmd by admin: Processing : show web ssl-port (cmd md5: b1b5f52fb19539d353d42d9a9c331f5e)`  
  `
  [DATE TIME] mgmt-server xpand[4604]: admin localhost t -volatile:clish:admin:534`  
  `
  [DATE TIME] mgmt-server clish[534]: User admin finished running clish -c from CLI shell`  
  `
  [DATE TIME] mgmt-server xpand[4604]: admin localhost t +volatile:clish:admin:735 t`  
  `
  [DATE TIME] mgmt-server clish[735]: User admin running clish -c with ReadWrite permission`  
  `
  [DATE TIME] mgmt-server clish[735]: cmd by admin: Start executing : ver (cmd md5: 0812f14f43315611dd0ef462515c9d00)
  [DATE TIME] mgmt-server clish[735]: cmd by admin: Processing : ver (cmd md5: 0812f14f43315611dd0ef462515c9d00)`  
  `
  [DATE TIME] mgmt-server xpand[4604]: admin localhost t -volatile:clish:admin:735`  
  `
  [DATE TIME] mgmt-server clish[735]: User admin finished running clish -c from CLI shell`  
  `
  [DATE TIME] mgmt-server xpand[4604]: admin localhost t +volatile:clish:admin:798 t`  
  `
  [DATE TIME] mgmt-server clish[798]: User admin running clish -c with ReadWrite permission`  
  `
  [DATE TIME] mgmt-server clish[798]: cmd by admin: Start executing : show web ... (cmd md5: b1b5f52fb19539d353d42d9a9c331f5e)`  
  `
  [DATE TIME] mgmt-server clish[798]: cmd by admin: Processing : show web ssl-port (cmd md5: b1b5f52fb19539d353d42d9a9c331f5e)`  
  `
  [DATE TIME] mgmt-server xpand[4604]: admin localhost t -volatile:clish:admin:798
  [DATE TIME] mgmt-server clish[798]: User admin finished running clish -c from CLI shell`

* The command `'who'` shows active connection open:  

  `[Expert@mgmt-server:0]# who`  

  `admin tty1 Apr 30 08:19`  

  `admin pts/1 Apr 30 11:26 (10.70.1.1)`

* Audit logs WEB_API login logout every few seconds.

## Cause

A user is running "watch api status" from console or ssh session.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content