> Source: [sk181601](https://support.checkpoint.com/results/sk/sk181601)

# sk181601 - Not possible to delete a configured Remote Syslog Server from Gaia OS settings after an upgrade to R81.20

| Property | Value |
|----------|-------|
| Solution ID | sk181601 |
| Date Created | 2023-12-12 |
| Last Modified | 2025-09-19 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server |
| Versions | R81.20, R81.20 |
| OS | Gaia |

## Symptoms

- * After an upgrade to R81.20, it is not possible to delete a configured Remote Syslog Server from Gaia OS settings that was configured in a previous version.

* In Gaia Portal \> "System Management" section \> "System Logging" page \> "Remote System Logging" section, the delete operation does not fail, but the configured Syslog Server is not removed.

* In Gaia Clish, the command "`delete syslog log-remote-address`" does not fail, but the configured Syslog Server is not removed (the command "`show syslog all`" still shows it).

## Cause

The Syslog Server settings are saved in different ways in the Gaia OS database in the R81.20 version comparing to lower versions.

As a result, Gaia OS cannot delete the required entry from the Gaia OS database.

In the Gaia OS database, after the "selector" parameter the separator character changed from ":" to "space".

* Example 1 - from the Gaia OS database in the R81.20 version:

  ```
  [Expert@Gaia:0]# dbget -rv syslog | grep 192.168.20.30
  syslog:action:remote:192.168.20.30:selector all.all
  [Expert@Gaia:0]#
  ```

* Example 2 - from the Gaia OS database in the R81.20 version:

  ```
  [Expert@Gaia:0]# dbget -rv syslog | grep 192.168.20.30
  syslog:action:remote:192.168.20.30:selector all.info
  [Expert@Gaia:0]#
  ```

* Example 3 - from the Gaia OS database in the R81.10 version:

  ```
  [Expert@Gaia:0]# dbget -rv syslog | grep 192.168.20.30
  syslog:action:remote:192.168.20.30 t
  syslog:action:remote:192.168.20.30:selector:all.all t
  [Expert@Gaia:0]#
  ```

* Example 4 - from the Gaia OS database in the R81.10 version:

  ```
  [Expert@Gaia:0]# dbget -rv syslog | grep 192.168.20.30
  syslog:action:remote:192.168.20.30 t
  syslog:action:remote:192.168.20.30:selector:all.info t
  [Expert@Gaia:0]#
  ```

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point Quantum R82](https://support.checkpoint.com/results/sk/sk181127)

Check Point recommends to always upgrade to the most recent version.

**If you choose not to upgrade, then this workaround is available:**
> **Notes:**
>
> The commands below use an example remote Syslog Sever IP address 192.168.20.30
>
> Example 1 from the Gaia OS database:
>
> * A correct entry (with the space):
>
>   `syslog:action:remote:192.168.20.30:`selector `all.all`
> * A problematic entry (with the colon):
>
>   `syslog:action:remote:192.168.20.30:`selector:`all.all`
>
> Example 2 from the Gaia OS database:
>
> * A correct entry (with the space):
>
>   `syslog:action:remote:192.168.20.30:`selector `all.info`
> * A problematic entry (with the colon):
>
>   `syslog:action:remote:192.168.20.30:`selector:`all.info`
>
> **Procedure:**
>
> 1. Connect to the command line on Gaia server.
>
> 2. Log in to the Expert mode.
>
> 3. Back up the current Gaia OS database:
>
>    1. `cp -v /config/db/initial{,_BACKUP}`
>
>    2. `cp -v /config/db/initial_db{,_BACKUP}`
>
> 4. Add a entry for the Syslog Sever IP address:
>
>    `dbset syslog:action:remote:192.168.20.30`
> 5. Configure the "*selector*" parameter with one space as a separator character:
>
>    * For the Example 1 above:
>
>      `dbset syslog:action:remote:192.168.20.30:selector all.all`
>    * For the Example 2 above:
>
>      `dbset syslog:action:remote:192.168.20.30:selector all.info`
> 6. Configure the "*selector*" parameter with one colon as a separator character:
>
>    * For the Example 1 above:
>
>      `dbset syslog:action:remote:192.168.20.30:selector:all.all`
>    * For the Example 2 above:
>
>      `dbset syslog:action:remote:192.168.20.30:selector:all.info`
> 7. Save the changes in the Gaia OS database:
>
>    `dbset :save`
> 8. Delete the Syslog Sever from the Gaia OS database in **one** of these ways:
>
>    * In Gaia Portal:
>
>      1. In the **System Management** section, click the **System Logging** page.
>
>      2. In the **Remote System Logging** section, click the Syslog Server entry and click **Delete**.
>
>    * In Gaia Clish:
>
>      1. Delete the Syslog Server:
>
>         `delete syslog log-remote-address 192.168.20.30`
>      2. Save the changes:
>
>         `save config`
>      3. Make sure the changes were saved:
>
>         `show syslog all`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content