> Source: [sk98068](https://support.checkpoint.com/results/sk/sk98068) # sk98068 - Gaia Limitations after Snapshot Recovery | Property | Value | |----------|-------| | Solution ID | sk98068 | | Date Created | 2014-01-16 | | Last Modified | 2026-10-22 | | Technical Level | General | | Products | Security Gateway, Security Management Server, Check Point Firewall | | Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.20, R81 (EOS) | | OS | Gaia | | Platform | Smart-1, 15000, 3000, 5000, Maestro Orchestrator, TE | ## Solution ### Introduction The Gaia Image Management feature lets administrators create a new image (a snapshot) of the system and later revert the system to that snapshot.. The snapshot creates a binary image of the root (`lv_current`) disk partition. It includes all of the operating system files and various Check Point software files. Because the *log* partition is ***not*** included in the snapshot, data stored on this partition, such as Firewall logs and events, is not saved. See the **Limitations of the Gaia Image Management feature** section below. You can revert to a snapshot in one of these ways: * Gaia Clish * Gaia Portal - "**Snapshot Management**" page * Gaia Portal First Time Wizard - "**Import existing snapshot**" option Gaia OS supports exporting an image from one server, and importing and restoring that image on another server of the same type. For example, you can use this capability in RMA cases. **Note -** If you configured network settings on the original server in the **Gaia Portal**, such as changing the IP address of an interface, the MAC addresses of the original server are also saved. When you export the image, the MAC addresses are exported with it. When you import the image on another server, the MAC addresses are deployed on that server. Limitations of the Gaia Image Management feature ------------------------------------------------ (1) General * Perform Snapshot and Revert operations on Check Point appliances of the same model or on Open Servers with the same hardware. * User data stored in the `/var/log/` partition is ***not*** saved as part of the snapshot. * When reverting to a snapshot created on a different server, the license may become invalid because of a MAC address change and might require reactivation. * You cannot import a snapshot if a snapshot with the same name already exists on the server. * You cannot revert to a Gaia AutoSnapshot in this scenario: 1. You take a manual Gaia snapshot on a server. 2. You upgrade the server to another version. The upgrade mechanism creates a Gaia AutoSnapshot. 3. You revert to the manual Gaia snapshot you took before the upgrade. 4. You cannot then revert to the Gaia AutoSnapshot that the upgrade mechanism created. * Because Gaia Snapshot copies only the root partition, if there are any symbolic links from one partition to another that change between versions, the revert might affect the symbolic links. **Example** : In R80.10, **/var/log/link** points to **/opt/dest1** , and in R80.20 it points to **/opt/dest2** . As a result, reverting a snapshot from one version to another might cause the symbolic link to be a broken link (because **/var/log/link** will still point to **dest1** when in R80.20 it should point to **dest2** ). The same applies to the other direction. For example, if **/opt/link** points to **/var/log/dest1** in R80.10, and to **/var/log/dest2** in R80.20, reverting the snapshot might also break the link. * Renaming an exported image is **not** supported. You cannot revert from a snapshot image that was renamed. The same limitation applies if you rename a snapshot directly on the Check Point Firewall. If you rename a snapshot file, errors such as the following might occur when trying to revert: > ``` > Checking all file systems. > [/sbin/fsck.ext3 (1) -- /] fsck.ext3 -a /dev/mapper/vg_splat-lv_Backup > fsck.ext3: No such file or directory while trying to open /dev/mapper/vg_splat-lv_Backup > /dev/mapper/vg_splat-lv_Backup: > The superblock could not be read or does not describe a correct ext2 > filesystem. If the device is valid and it really contains an ext2 > filesystem (and not swap or ufs or something else), then the superblock > is corrupt, and you might try running e2fsck with an alternate superblock: > e2fsck -b 8193 > > [FAILED] > > *** An error occurred during the file system check. > *** Dropping you to a shell; the system will reboot > *** when you leave the shell. > (Repair filesystem) 1 # > ``` * **Different Filesystem** - You cannot revert from a snapshot image that was upgraded from a previous version that used Ext3 file system. Starting in R80.20, Gaia Fresh Install has a default XFS file system. Solution: Fresh install to your FireWall version and revert from snapshot again. #### (2) SmartLog Firewall logs are **not**restored during a revert. #### (3) Threat Emulation Updated Threat Emulation engines, images, detection rules and logic may need to be downloaded again after reverting. #### (4) DLP * All DLP quarantined e-mails are **not**restored during a revert. * If the DLP Fingerprint data type was used on Check Point Firewalls before the revert, an additional reboot is required after the first policy installation. * DLP Fingerprint data types are **not** enforced until the next successful repository scan. * DLP Whitelist does **not**bypass files until the next successful repository scan. * DLP Dynamic Dictionary data types are **not**enforced until the next successful periodic scan. #### (5) SmartUpdate Packages uploaded with SmartUpdate to the Security Management Server before the revert are invalid after the revert. To resolve this, delete the packages from SmartUpdate and upload them again. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content