> Source: [sk185127](https://support.checkpoint.com/results/sk/sk185127)

# sk185127 - Maestro Security Group sends debug syslog messages despite Remote Syslog severity set to Info

| Property | Value |
|----------|-------|
| Solution ID | sk185127 |
| Date Created | 2026-07-22 |
| Last Modified | 2026-08-24 |
| Technical Level | Advanced |
| Products | Security Gateway, Scalable Platforms, Logging & Status |
| Versions | R82, R81.20, R82, R81.20, R81.20, R82 |
| OS | Gaia |

## Symptoms

- * A Gaia Maestro Security Group sends debug-level syslog messages to external syslog servers, even though the remote Syslog severity is configured as **Info** (in the Gaia Portal, under **System Management \> System Logging \> Remote System Logging** , the **Priority** field is set to **Info**.
* Debug-level syslog messages continue to reach the external syslog servers after you change the syslog severity and restart the syslog services.
* A review of the generated syslog configuration shows debug-related selectors. To see them, connect to the affected Security Group Member, log in to the Expert mode, and run `grep -nE "debug|local[0-7]" /config/active /etc/syslog.conf /etc/rsyslog.conf`. The output contains entries similar to these:
  * `/var/log/ports local3.=debug`

  * `/var/log/command_logger.log local1.=debug`

  * `/var/log/messages local6.!debug`

* The issue can affect one Security Group Member, while another Security Group Member appears corrected.

## Cause

Gaia generates the syslog configuration files from the Gaia configuration database. When these generated files are edited manually, the changes do not update the Gaia configuration database. The affected generated files are:

* `/config/active`

* `/etc/syslog.conf`

* `/etc/rsyslog.conf`

The debug-related local facility selectors remain stored in the Gaia configuration database. Therefore, each time the syslog service restarts or the configuration is regenerated, Gaia rebuilds the generated files from the database and restores those selectors. As a result, the configured external syslog severity (**Info**) does not remove the debug-level behavior until the debug selectors are cleared from the Gaia configuration database on each affected Security Group Member.

For each configured remote syslog destination, there are two selector entries in the Gaia config database (`dbget -rv syslog`):

<br />

> <br />
>
> * The "correct" selector entry that was configured by an administrator:   
>   `syslog:action:file:/var/log/ports:selector:local3.=info `
> * The "incorrect" selector entry that was generated automatically by Gaia:  
>   `syslog:action:file:/var/log/ports:selector:local3.=debug t `
>
> ```
>
> ```
>
> <br />
>
<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content