This article applies to:
Question:
What troubleshooting steps do I take to debug OPSEC LEA connection issues?
Information:
The OPSEC LEA connection used to retrieve log data from Check Point firewalls may, at times, be difficult to establish. Often, this is a result of a missed step in the Firewall Suite Configuration Guide, or misconfiguration of the firewall rule or the fwopsec.conf file. There are, however, other possible causes.
To access the Firewall Suite Configuration Guide please click the link below:
The following steps will help to determine what issues are occurring with the LEA service:
- Edit the
webtrends.ini file and under [Defaults] add the following line:
- Download DebugView from the following site:
- Delete any Firewall Suite profiles that use the OPSEC LEA connection.
- Exit and Unload Firewall Suite (close the application, not uninstall).
- Restart the machine where Firewall Suite is installed.
- Start DebugView and allow it to run in the background.
- Start Firewall Suite and create a new profile using OPSEC LEA.
- Check the Services window to ensure that the OPSEC LEA service has started. If not, manually try to start the service.
- If the OPSEC LEA service fails to start, note the data collected by DebugView for analysis.
The following table will provide some possible causes:
* CP - Check Point
|
Case |
DebugView Message |
Pause Before Result |
Solution |
| IP responds - CP not installed |
COMM_IS_DEAD |
Immediate |
Configure Firewall Suite to point to CP Management Server |
| IP does not respond |
COMM_IS_DEAD |
10-15 seconds |
Verify IP is correct; verify CP Management Server machine is configured correctly |
| IP responds - CP installed - fwopsec.conf not configured correctly |
COMM_IS_DEAD |
Immediate |
Configure fwopsec.conf by following instructions in Firewall Suite Configuration Guide |
| CP installed - ruleset "drops" OPSEC LEA connection from client |
COMM_IS_DEAD |
2-3 minutes |
Add/edit ruleset to allow OPSEC LEA traffic to and from CP Management Server and the Firewall Suite machine |
| CP installed - ruleset "rejects" OPSEC LEA connection from client |
COMM_IS_DEAD |
Immediate |
Add/edit ruleset to allow OPSEC LEA traffic to and from CP Management Server and the Firewall Suite machine |
| WebTrends OPSEC LEA Service times out the connection |
END_BY_APPLICATION |
5 minutes |
Varies; this message occurs when a connection was initiated, but timed out due to no response from Management Server |
Notes:
Do not run DebugView through Windows Terminal Services as no data on the LEA connection will appear.
- This article was previously published as:
- NETIQKB1542