MARS and Check Point Firewall Logging

Hi,
I have added my Check Point CMA object to MARS, but am not getting seeing any log information.  My CLM is a separate server (child enforcement module), which is discovered OK when the intial CMA discovery takes place in MARS.  I have configured the Log Info settings for the CLM entry in MARS with the SIC details for the Check Point MARS and CLM objects.
I've created a simple query to gather outbound ftp data (for which there is lots) and I am seeing nothing when running this query in MARS.  The associated CLM log shows plenty of entries.  I am keen to be able to get some historical logging data via MARS, so any help to resolve this issue would be appreciated.
Many thanks
Liam

Liam;
  CS-MARS<>Check Point integration can be very tricky and is very dependent on the versions of software involved.  You may be able to find out some additional insight into the process by raising the CS-MARS logging level for Check Point and monitoring the output.  This is accomplished from the CS-MARS CLI:
[pnadmin]$ pnlog setlevel cpdebug
You can then view the messages via the CLI as well:
[pnadmin]$ pnlog show cpdebug
  If this does not shed any light on the communication between CS-MARS and the Check Point devices, it would be best to open a service request with TAC to further troubleshooting can be performed.
Scott

Similar Messages

  • Since downloading IOS8, when I log in to certain websites that are password specific and check the stay logged in box, when I return to the home screen then back to the website I have to log in again which is very frustrating

    Since downloading IOS8 when I log in to certain websites that are password specific, despite checking the keep logged in box, when I go back to home screen then back to website, I have been logged out and have to log back in-very frustrating-any ideas please?

    To see registered devices in My account:
    1) Go to Account > My Account
    2) Scroll down, and ensure that that you first have an active subscrption (if you do not, you are not logged in to you Ovi Music unlimited account)
    3) Below Unlimited downloads subscription box, you should have a Registered devices box.
    Cheers,
    elin
    http://www.nokia.com/support
    Attachments:
    Music account.jpg ‏13 KB
    registered devices.jpg ‏49 KB

  • Concepts about Archieving process and Check point Background process

    I am still going through Oracle Architecture and presently on the background oracle process. I got struck about the function of Checkpoint process and how archieving process occurs. Any inputs from my friends here will be highly appreciated.

    916438 wrote:
    I am still going through Oracle Architecture and presently on the background oracle process. I got struck about the function of Checkpoint process and how archieving process occurs. Any inputs from my friends here will be highly appreciated. Checkpoint is an act of cleaning the dirty blocks from buffer cache to disks in order to make fast recovery(if happens) if crash happens. Having said this, this process will make sure that oracle has to recovery minimum numbers of dirty block on instance recovery phase. So there is periodic flushing of dirty blocks from buffer cache to disks. In this periodic time CKPT process will post to DBWR process to write out the dirty blocks to disks. This is basically called the incremental checkpointing.
    In incremental checkpointing oracle will keep the record of most oldest block in controlfile and from this block (which is also called RBA), oracle will start recovering dirty blocks.
    There is also a full checkpoint in oracle which happen when redolog switch
    Now coming to archiving: An archive log is a copy of redo log files, it includes the sequence number and redo entries. Whenever there is a log switch (redo log files gets filled in circular fashion), then arch process will start archive filled redo log file. So during this process arch process will read the filled redo log files and make the copy of it in archive file. LGWR cannot write this filled redo file until ans unless arch process completes copying of redolog entries to archive log file.
    Archive log files are required for recovery if in future we wish to recover database during media/datafile/controlfile failure.
    Also see
    http://asktom.oracle.com/pls/asktom/f?p=100:11:0::::P11_QUESTION_ID:19311485023372 - Checkpoint explained
    http://docs.oracle.com/cd/B19306_01/server.102/b14231/archredo.htm - Archives
    Edited by: 909592 on Mar 25, 2012 5:34 PM

  • Why Are There Multiple Instances Of Firefox Preparing To Access Internet According To Firewall Log When I'm Not Launching Them And Nothing Appeared On My Screen

    I had closed Firefox after briefly running it and then tried to reopen it anew but got a message that said "Firefox is already running but is not responding. To open a new window, you must first close the existing Firefox process, or restart your system."
    I logged off my computer, and later restarted. However, when I checked my Firewall log it showed that during the minute I had my computer on earlier there were about a dozen instances of "Firefox is preparing to access the internet" which were recorded just seconds apart.
    I don't have the problem now -- restarting apparently took care of the issue -- but I don't understand why there were so many instances of Firefox preparing to access the internet when I was not clicking on it all those times, the one time I did I got a message that it already was running, and there were no tabs on my screen to reflect all those supposed instances.
    Thanks for any insight that folks can offer.

    Were that Firefox processes or plugin-container processes?
    *http://kb.mozillazine.org/Plugin-container_and_out-of-process_plugins
    *https://support.mozilla.org/kb/What+is+plugin-container
    In case you are using "Clear history when Firefox closes", try to exclude the cookies in case you currently have selected this.
    *Tools > Options > Privacy > Firefox will: "Use custom settings for history": [X] "Clear history when Firefox closes" > Settings
    *https://support.mozilla.org/kb/Clear+Recent+History
    Note that clearing "Site Preferences" clears all exceptions for cookies, images, pop-up windows, software installation, and passwords.
    Firefox will try to remove cookies created by plugins in case you clear the cookies and that can result in plugin-container processes getting created.

  • Firewall Logging

    I've checked my firewall log out of curiousity a few days ago and was quite shocked to find a huge amount of entries on it. I don't really know how I have to interprete all of the log messages such as iMac ipfw: Stealth Mode connection attempt to ... and others. Is there any reference document I can use to understand all of those messages and to find out if I need to be worried about them?
    iMac (Flat Panel); iBook G4   Mac OS X (10.4)  

    Those messages indicate that a remote machine was trying to connect to your computer using the http and https protocols. The second set of addresses belongs to a computer on Apple's support site; if you were accessing it through your web browser at the time over a secure(https) connection, those messages may appear.
    (8951)

  • Check Point VPN-1 with E71

    Hi, Im trying to setup VPN between Check Point VPN-1 R65 gateway and Nokia E71 device. I am using Nokia Policy tool which should generate a policy for the device. The policy includes user's certificate which is loaded via policy tool.
    My p12 certificate is generated by Check Point internal CA, but when Im trying to load the policy on the device, it fails with the error message "user certificate is not found".
    I converted Check Point p12 certificate into PFX certificate using Microsoft CAPI import/export. The output is a certificate which can be loaded into the device, however something happended with the signature and Check Point gateway refuses to communicate (error: invalid signature "empty")
    Any clues ?
    Thanks

    The CheckPoint VPN-1 Secure Client software is only compatible with Mac OS v 10.3 (Panther). I had the same issue and am waiting for CheckPoint to update the software.
    Miguel

  • Firewall log permission

    I just installed scheduled system updates and rebooted, now when I try to open the ipfw log it says "you don't have permission to read this log".
    This is after I enter the administrator's password. Before the update to 10.4.11 I was able to open and read the firewall log just fine. What happened?
    Thanks

    Check the Permissions on that file, here I get...
    Owner - system R&W
    Group - admin = RO
    Others - No Access

  • RV180W firewall logging

    Hi,
    I have a fairly simple need that I can't seem to satisfy with the RV180W. I've set a firewall block rule for certain traffice lan>wan, and I'd like to view the log.
    Administratration | Firewall | Firewall Logs, I can select any or all items. Where do I view the log?
    I can go to Logging | Logging Policies and select everything for the 'default' policy.
    No matter what, I go to Status | View Logs, and select whatever severity level I want but get little to nothing, and definitely no firewall logging.
    What am I missing?
    Thanks, Les.                  

    I don't see a "logging" option where the firewall rules are configured:
    Under Firewall>Port Forwarding my options are:
    Action:            
    Schedule:
    Service:                              
    Source IP:                    
    Start:          (xxx.xxx.xxx.xxx)
    Finish:          (xxx.xxx.xxx.xxx)
    Destination IP:          (xxx.xxx.xxx.xxx)          
    Internal Port:
    Under Firewall>Access Rules my options are:
    Connection Type:                    
    Action:                    
    Schedule:
    Service:                              
    Source IP:                    
    Start:
    Finish:
    Destination IP:                    
    Start:
    Finish:
    Use This SNAT IP Address:          
    SNAT IP:
    Send to Local Server (DNAT IP):                     
    Use Other WAN (Internet) IP Address:          
    WAN (Internet) Destination IP:
    Rule Status:
    Under Firewall>Advanced>Custom Services my options are:
    Name:                    
    Type:                     
    ICMP Type:
    Start Port:                    
    Finish Port:                    
    Protocol Number:
    Where should this logging be set?  I have already turned on the logging under Administration>Logging>Firewall Logs, but when I got to Status>ViewLogs I can only see stuff that I configure using Administration>Logging>Logging Policies.
    Still cannot find how to display the actual firewall/router logs.

  • The crawler could not communicate with the server. Check that the server is available and that the firewall access is configured correctly. If the repository was temporarily unavailable, an incremental crawl will fix this error

    We are getting the below error when we see in Crawl logs
    "The crawler could not communicate with the server. Check that the server is available and that the firewall access is configured correctly. If the repository was temporarily unavailable, an incremental crawl will fix this error."
    This is happening in FAST search.
    Here I can see soke of the logs related to this search crawl.
    Could anyone please help on this?
    web application 'http://xvy/' doesn't use search application 'FAST Query SSA', skipping it.
    ABC\sp_search' on web application 'http://xvy/'. 2d7dba01-3d2e-4903-b59f-9a8601627bcd
    07/30/2014 01:30:46.65  OWSTIMER.EXE (0x28DC)                    0x1BC0 SharePoint Server Search       Administration               
     dl2m Verbose  Search application 'Search Service Application 1': Skipping web application '48ed7882-9f70-424e-bf72-e3c9f5340b97' because its outbound url 'http://ebc:30347' was automatically added once.
    Ensure full read access to the indexing account 'ABC\sp_search' on web application 'http://nvcp/'. 85041609-d618-4132-ac8e-195a910d99a0
    07/30/2014 01:31:46.53  OWSTIMER.EXE (0x28DC)                    0x05F4 SharePoint Server Search       Administration               
     dl2m Verbose  Search application 'FAST Query SSA': Skipping web application '57718ea1-8cb5-4adc-abd2-9e55415e5791' because its outbound url 'http://nvcp' was automatically added once. 85041609-d618-4132-ac8e-195a910d99a0
    07/30/2014 01:31:46.53  OWSTIMER.EXE (0x28DC)                    0x05F4 SharePoint Server Search       Administration               
     dl2n Verbose  Search application 'FAST Query SSA': Adding start address 'http://nvcp' for web application '57718ea1-8cb5-4adc-abd2-9e55415e5791' to list of valid start addresses. 85041609-d618-4132-ac8e-195a910d99a0
    07/30/2014 01:31:46.53  OWSTIMER.EXE (0x28DC)                    0x05F4 SharePoint Server Search       Administration               
     dmb6 Verbose  Ensure full read access to the indexing account 'ABc\sp_search' on web application 'http://nvcp'ext/'. 85041609-d618-4132-ac8e-195a910d99a0
    07/30/2014 01:31:46.53  OWSTIMER.EXE (0x28DC)                    0x05F4 SharePoint Server Search       Administration               
     dl2m Verbose  Search application 'FAST Query SSA': Skipping web application '64d562a1-535e-4917-8979-88840e2a67fe' because its outbound url 'http://nvcp'ext' was automatically added once. 85041609-d618-4132-ac8e-195a910d99a0
    07/30/2014 01:31:46.53  OWSTIMER.EXE (0x28DC)                    0x05F4 SharePoint Server Search       Administration               
     dl2n Verbose  Search application 'FAST Query SSA': Adding start address 'http://nvcpext' for web application '64d562a1-535e-4917-8979-88840e2a67fe' to list of valid start addresses. 85041609-d618-4132-ac8e-195a910d99a0
    07/30/2014 01:31:46.53  OWSTIMER.EXE (0x28DC)                    0x05F4 SharePoint Server Search       Administration               
     dmb6 Verbose  Ensure full read access to the indexing account 'ABC\sp_search' on web application 'http://nvcpnew/'. 85041609-d618-4132-ac8e-195a910d99a0
    executing SQL query {? = call dbo.proc_MSS_PropagationIndexerGetReadyQueryComponents}  [propdatabase.cxx:70]  d:\office\source\search\native\ytrip\tripoli\propagation\propdatabase.cxx 
    07/30/2014 01:32:04.31  mssearch.exe (0x0588)                    0x1DE4 SharePoint Server Search       Propagation Manager          
     e3o3 Verbose  executing SQL query {? = call dbo.proc_MSS_PropagationIndexerGetReadyQueryComponents}  [propdatabase.cxx:70]  d:\office\source\search\native\ytrip\tripoli\propagation\propdatabase.cxx 
    07/30/2014 01:32:04.68  mssdmn.exe (0x15CC)                      0x1060 SharePoint Server Search       HTTP Protocol
    Handler          du4i                     0x29E4 SharePoint Server Search       HTTP
    Protocol Handler          du4i Verbose  CHttpAccessorHelper::InitRequestInternal - opening request for '/robots.txt'.   [httpacchelper.cxx:353]  d:\office\source\search\native\gather\protocols\http\httpacchelper.cxx 
    07/30/2014 01:32:04.70  mssdmn.exe (0x15CC)                      0x29E4 SharePoint Server Search       HTTP Protocol
    Handler          du54 High     CHttpAccessorHelper::InitRequestInternal - unexpected status (503) on request for 'http://ppecpnew/robots.txt' Authentication 0.  [httpacchelper.cxx:703] 
    d:\office\source\search\native\gather\protocols\http\httpacchelper.cxx 
    07/30/2014 01:32:04.70  mssearch.exe (0x0588)                    0x130C SharePoint Server Search       Gatherer                     
     cd11 Warning  The start address http://nvcp'/sites/quipme cannot be crawled.  Context: Application 'FAST_Content_SSA', Catalog 'Portal_Content'  Details: 
    The crawler could not communicate with the server. Check that the server is available and that the firewall access is configured correctly. If the repository was temporarily unavailable, an incremental crawl will fix this error.   (0x80041200) 
    07/30/2014 01:32:04.70  mssdmn.exe (0x15CC)                      0x104C SharePoint Server Search       HTTP Protocol
    Handler          du4i Verbose  CHttpAccessorHelper::InitRequestInternal - opening request for '/robots.txt'.   [httpacchelper.cxx:353]  d:\office\source\search\native\gather\protocols\http\httpacchelper.cxx 
    07/30/2014 01:32:04.70  mssdmn.exe (0x15CC)                      0x104C SharePoint Server Search       HTTP Protocol
    Handler          du54 High  
    07/30/2014 01:32:04.70  mssearch.exe (0x0588)                    0x2948 SharePoint Server Search       Gatherer                     
     cd11 Warning  The start address
    http://nvcp'/sites/MDPPubng cannot be crawled.  Context: Application 'FAST_Content_SSA', Catalog 'Portal_Content'  Details:  The crawler could not communicate with the server. Check that the server is
    available and that the firewall access is configured correctly. If the repository was temporarily unavailable, an incremental crawl will fix this error.   (0x80041200) 
     CHttpProbeHelper::ProbeServer: InitRequest failed for 'http://ppecpnew/_vti_bin/sitedata.asmx'. Return error to caller, hr=80041200  [stscommon.cxx:490]  d:\office\source\search\native\gather\protocols\common\stscommon.cxx 
    07/30/2014 01:32:26.06  mssdmn.exe (0x15CC)                      0x193C SharePoint Server Search       PHSts                        
     dvg0 High     STS3::COWSServer::InitializeClaimsCookie: Probing url 'http://pncvr' failed. Return error to caller, hr=80041200  [sts3util.cxx:1332]  d:\office\source\search\native\gather\protocols\sts3\sts3util.cxx 
    07/30/2014 01:32:26.06  mssdmn.exe (0x15CC)                      0x193C SharePoint Server Search       PHSts                        
     en0e High     CSTS3Accessor::InitURLType: Return error to caller, hr=80041200                 [sts3acc.cxx:2214]  d:\office\source\search\native\gather\protocols\sts3\sts3acc.cxx 
    07/30/2014 01:32:26.06  mssdmn.exe (0x15CC)                      0x193C SharePoint Server Search       PHSts                        
     dv3p High     CSTS3Accessor::GetServer fails, Url sts4://pnvpr/siteurl=sites/product/siteid={7ebfb072-08a8-4df7-8f74-e06730325d9a}/weburl=/webid={bd7ae724-1256-4b26-9633-416447d6bc5c}, hr=80041200  [sts3acc.cxx:185] 
    d:\office\source\search\native\gather\protocols\sts3\sts3acc.cxx 
    07/30/2014 01:32:26.06  mssdmn.exe (0x15CC)                      0x193C SharePoint Server Search       PHSts                        
     dvb1 High     CSTS3Accessor::Init fails, Url sts4:/mngbv/siteurl=sites/product/siteid={7ebfb072-08a8-4df7-8f74-e06730325d9a}/weburl=/webid={bd7ae724-1256-4b26-9633-416447d6bc5c}, hr=80041200  [sts3handler.cxx:312] 
    d:\office\source\search\native\gather\protocols\sts3\sts3handler.cxx 
    07/30/2014 01:32:26.06  mssdmn.exe (0x15CC)                      0x16FC SharePoint Server Search       HTTP Protocol
    Handler          du2z Verbose  CHttpProbeHelper::ProbeServer: Probing server with url 'http://pnvpr/_vti_bin/sitedata.asmx'.  [stscommon.cxx:476]  d:\office\source\search\native\gather\protocols\common\stscommon.cxx 
    07/30/2014 01:32:26.08  mssdmn.exe (0x15CC)                      0x193C SharePoint Server Search       PHSts                        
     dvb2 High     CSTS3Handler::CreateAccessorExD: Return error to caller, hr=80041200            [sts3handler.cxx:330]  d:\office\source\search\native\gather\protocols\sts3\sts3handler.cxx 
    07/30/2014 01:32:26.08  mssdmn.exe (0x15CC)                      0x16FC SharePoint Server Search       HTTP Protocol
    Handler          du4i Verbose  CHttpAccessorHelper::InitRequestInternal - opening request for '/_vti_bin/sitedata.asmx'.  [httpacchelper.cxx:353]  d:\office\source\search\native\gather\protocols\http\httpacchelper.cxx 
    earch application 'FAST Query SSA': Adding start address 'http://mnvfgext' for web application '64d562a1-535e-4917-8979-88840e2a67fe' to list of valid start addresses. a6b7948a-dc16-419d-b58a-0ee798a0bb9c
    07/30/2014 01:32:46.53  OWSTIMER.EXE (0x28DC)                    0x1444 SharePoint Server Search       Administration               
     dmb6 Verbose  Ensure full read access to the indexing account 'ABC\sp_search' on web application 'http://nvpr/'. a6b7948a-dc16-419d-b58a-0ee798a0bb9c
    07/30/2014 01:32:46.53  OWSTIMER.EXE (0x28DC)                    0x1444 SharePoint Server Search       Administration               
     dl2m Verbose  Search application 'FAST Query SSA': Skipping web application 'cea7b67b-fd5f-4c9a-a300-64a7d7ca3093' because its outbound url 'http://pnvpr' was automatically added once. a6b7948a-dc16-419d-b58a-0ee798a0bb9c
    07/30/2014 01:32:46.53  OWSTIMER.EXE (0x28DC)                    0x1444 SharePoint Server Search       Administration               
     dl2n Verbose  Search application 'FAST Query SSA': Adding start address 'http://pnvpr' for web application 'cea7b67b-fd5f-4c9a-a300-64a7d7ca3093' to list of valid start addresses. a6b7948a-dc16-419d-b58a-0ee798a0bb9c
    07/30/2014 01:32:46.53  OWSTIMER.EXE (0x28DC)                    0x1444 SharePoint Server Search       Administration               
     dl2k Verbose  web application 'http://abcrsp/' doesn't use search application 'FAST Query SSA', skipping it. a6b7948a-dc16-419d-b58a-0ee798a0bb9c
    07/30/2014 01:32:46.53  OWSTIMER.EXE (0x28DC)                    0x1444 SharePoint Server Search       Administration               
     dl2k Verbose  web application 'http://excb/' doesn't use search application 'FAST Query SSA', ski
    Anil Loka

    Hi,
    According to your post, my understanding is that you got error when communicating to the server.
    This happens when crawler is not able to connect to the server. Make sure server name is correct. Couple of steps to troubleshoot it
    You should be able to ping the server from the server having crawl component. Make sure there is an entry for the server in the host file under c:\Windows\System32\drivers\etc folder.
              Ping <servername>
          2.  You should be able to connect to the server using telnet command
    Telnet< servername> <port number>
    More information:
    Troubleshooting of FAST Search Configuration
    If the issue still exists, you can delete the old search application and recreate from the beginning.
    You can also reset the index and do a full crawl after.
    Here is a similar thread for your reference:
    http://social.technet.microsoft.com/Forums/en-US/f3c61b53-304a-4c2a-a370-d0e573219d1d/an-unrecognized-http-response-was-received-when-attempting-to-crawl-this-item?forum=sharepointadminprevious
    Best Regards,
    Linda Li
    Linda Li
    TechNet Community Support

  • Norton Firewall logging connections from usr/sbin/nmbd every 6 seconds...  What is this, and how can I stop it?

    This whole situation first started with a complaint from my ISP that it appeared I had a trojan virus...  around 1100-1200 messages per hour were being run through their servers via my account.  I have also Anti-Virus enabled, so I was left scratching my head...
    No viruses found on a full scan - so I started watching processes and connections.  This nmbd process is suspicious...  I don't run windows file sharing, nor have I ever.  This just popped up recently.  I also had two mac tech support calls, and one to Symantec - and it ran fine for a couple of days - but it's back again. 
    What is this, and how can I find the culprit, and remove it permanently...?
    Thanks in advance for any advice!
    --Jeff

    Thanks Thomas, appreciate the insight!  Thanks for taking the time to help me think through this...
    I have reset the password  twice now...
    It's only impacting one account, and the ISP says it's local to me - somewhere on my local network.
    I do have a few devices on my home network.  The only one with windows is my macbook air running parallels.  I just use this to browse some web projects I work on (view in IE to make sure everything is looking like it should). 
    The passwords I have used both times - they were ones set by my isp - the type you can't remember, they seem rather strong (upper/lower case letters, numbers, symbols).  That's what leads me to believe it's also local - something on my machine.  And it only seems to be impacting one email account (I have 5 running in Mac Mail).
    WiFi network is protected by WPA2 - just checked to be sure.  All good there.
    Now, in Norton Firewall log - I can see incoming and outgoing connections via Windows File Sharing/nmbd. 
    The reason I feel/felt that this is related to the spam sends is that once I saw the number of connects, and roughly equals the number of sends per hour of spam - I stopped the process with the firewall and suddenly my isp says the spam sends stop. That led me to believe they are related. Perhaps this virus or malware has spoofed it's name and is identifying itself as nmbd?  I have no idea.  Just scared to turn it all off just yet.
    I did notice that Moutain Lion does not run this...  (nmbd).
    I did wonder about the Air sending something off of windows - but this all happened while it was off, laying on the desk next to me.  It rarely gets used unless I'm testing or traveling.
    I can understand nmbd being useful part of the system, I cannot understand how it would be very useful if I didn't turn it on, it connects at that frequency, and I don't have file sharing enabled.  That's why I am hesitant to turn Norton off, and hope that everything just goes away.  I want to try and get this problem figured out as simply turning Norton off doesn't seem like I'm taking steps to eliminate the problem.  Perhaps Norton is causing other issues - and I'll be removing the software asap - but want to make sure the spam sends cease.
    Let me know if that sparks any ideas...  Thanks again! 
    --Jeff

  • Stealth mode and firewall logging problems to be resolved please.

    I am running OS X v10.6.8 and am having difficulty setting stealth mode. System Preferences shows stealth mode to be switched on, but System Profiler shows it to be off, no matter how many times I set it and shut down/restart. System profiler also shows firewall logging to be switched off, but there is no facility within the Security/Firewall section of System Preferences to switch it on.

    I think the answer to this is if you have "Block all incoming connections" checked, then "Enable stealth mode" in Sys Prefs is checked but greyed out. Mine is set up that way and I'm seeing, like you, that Stealth Mode is off in System Profiler>Network>Firewall. If you have "Block all incoming" checked, then activating Stealth Mode becomes moot.
    I can only get it undimmed if I uncheck Block all incoming.

  • Windows Server 2008 and Firewall Logging

    Our Windows server 2008 R2 domain controller does not appear to be logging anything into the windows firewall log: c:\windows\system32\logfiles\firewall\pfirewall.log.  The file is always blank.  Every 2003 server and 2008 R2 non-dc work fine. 
    I'm a little stumped.  The firewalls are configured via GPO's and appear to be applied ok. 
    I compared the 2003 and 2008 configuration and did notice one discrepancy:
    The 2003 windows firewall service runs as the local system account.  It's effective permissions to the pfirewall.log file is "full control"
    However, the 2008 firewall service runs as "LOCAL SERVICE".  This account has read-only permissions to the pfirewall.log file. 
    I haven't changed anything as this is a production server.  I was hoping for some guidance before I start changing default settings.  Any ideas why the pfirewall.log file is always blank?
    Thanks!

    Hi,
    Generally, C:\Windows\System32\LogFiles\Firewall\firewall.log has the following permission settings:
    NT SERVICE\MpsSvc:(F)
    NT AUTHORITY\SYSTEM:(F)
    BUILTIN\Administrators:(F)
    BUILTIN\Network Configuration Operators:(F)
    Please make sure MPSSvc (Windows Firewall service) has Full Control on this file.
    Thanks.
    This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question.
    This can be beneficial to other community members reading the thread.
    This worked for me on a 2008 R2 DC that had somehow dropped the MpsSvc account off the Permissions list. In my case the pfirewall.log file wasn't even being created, so I had to modify permissions for the "%systemroot%\System32\LogFiles\Firewall"
    folder.
    Adding the MpsSvc account can be tricky if you're not familiar with where to look. Here are some supplemental instructions that might prove useful to those like myself who might not do this type of thing every day. Remember that these instructions for for
    a 2008 R2 Domain Controller.
    Open the "%systemroot%\System32\LogFiles\Firewall" folder. If necessary, "Click Continue to permanently get access to this folder."
    Right-click the empty space in the Firewall folder and click Properties.
    Go to the Security tab and click the Edit button.
    In the "Permissions for Firewall" window, click the Add
    button. The next step is where it gets tricky.
    Click the Object Types button and in the window that opens, make sure the
    Service Accounts box is checked. Click OK.
    Now click the Locations button. In the window that opens, make sure you change the default selection from the domain name to your Domain Controller's hostname (e.g. DC01).
    Click OK.
    In the object names text field, type "NT SERVICE\MpsSvc". If you were to simply enter "MpsSvc" it wouldn't work. This is not case sensitive, but the context of your entry is very specific.
    Click Check Names and your entry should automatically change to an underlined "MpsSvc" value.
    Click OK.
    Back on the "Permissions for Firewall" window, you can give MpsSvc
    Full Control of the Firewall folder, then click OK.
    You'll see a warning about changing permission settings on system folders. Read it, and if you accept the risk, click
    Yes. (Otherwise click No and enjoy your non-existent firewall logs.)
    Click OK again to save your changes and close the
    Firewall Properties window.
    You may have to restart the Windows Firewall service before the firewall log file will appear.
    You should also run a "gpupdate" just to make sure your settings are permanent and aren't being overridden by a GPO somewhere out there in Active Directory.
    That's all folks!
    "This posting is provided "AS IS" with no warranties, and confers no rights."
    -Mike

  • (Cisco Historical Reporting / HRC ) All available connections to database server are in use by other client machines. Please try again later and check the log file for error 5054

    Hi All,
    I am getting an error message "All available connections to database server are in use by other client machines. Please try again later and check the log file for error 5054"  when trying to log into HRC (This user has the reporting capabilities) . I checked the log files this is what i found out 
    The log file stated that there were ongoing connections of HRC with the CCX  (I am sure there isn't any active login to HRC)
    || When you tried to login the following error was being displayed because the maximum number of connections were reached for the server .  We can see that a total number of 5 connections have been configured . ||
    1: 6/20/2014 9:13:49 AM %CHC-LOG_SUBFAC-3-UNK:Current number of connections (5) from historical Clients/Scheduler to 'CRA_DATABASE' database exceeded the maximum number of possible connections (5).Check with your administrator about changing this limit on server (wfengine.properties), however this might impact server performance.
    || Below we can see all 5 connections being used up . ||
    2: 6/20/2014 9:13:49 AM %CHC-LOG_SUBFAC-3-UNK:[DB Connections From Clients (count=5)]|[(#1) 'username'='uccxhrc','hostname'='3SK5FS1.ucsfmedicalcenter.org']|[(#2) 'username'='uccxhrc','hostname'='PFS-HHXDGX1.ucsfmedicalcenter.org']|[(#3) 'username'='uccxhrc','hostname'='PFS-HHXDGX1.ucsfmedicalcenter.org']|[(#4) 'username'='uccxhrc','hostname'='PFS-HHXDGX1.ucsfmedicalcenter.org']|[(#5) 'username'='uccxhrc','hostname'='47BMMM1.ucsfmedicalcenter.org']
    || Once the maximum number of connection was reached it threw an error . ||
    3: 6/20/2014 9:13:49 AM %CHC-LOG_SUBFAC-3-UNK:Number of max connection to 'CRA_DATABASE' database was reached! Connection could not be established.
    4: 6/20/2014 9:13:49 AM %CHC-LOG_SUBFAC-3-UNK:Database connection to 'CRA_DATABASE' failed due to (All available connections to database server are in use by other client machines. Please try again later and check the log file for error 5054.)
    Current exact UCCX Version 9.0.2.11001-24
    Current CUCM Version 8.6.2.23900-10
    Business impact  Not Critical
    Exact error message  All available connections to database server are in use by other client machines. Please try again later and check the log file for error 5054
    What is the OS version of the PC you are running  and is it physical machine or virtual machine that is running the HRC client ..
    OS Version Windows 7 Home Premium  64 bit and it’s a physical machine.
    . The Max DB Connections for Report Client Sessions is set to 5 for each servers (There are two servers). The no of HR Sessions is set to 10.
    I wanted to know if there is a way to find the HRC sessions active now and terminate the one or more or all of that sessions from the server end ? 

    We have had this "PRX5" problem with Exchange 2013 since the RTM version.  We recently applied CU3, and it did not correct the problem.  We have seen this problem on every Exchange 2013 we manage.  They are all installations where all roles
    are installed on the same Windows server, and in our case, they are all Windows virtual machines using Windows 2012 Hyper-V.
    We have tried all the "this fixed it for me" solutions regarding DNS, network cards, host file entries and so forth.  None of those "solutions" made any difference whatsoever.  The occurrence of the temporary error PRX5 seems totally random. 
    About 2 out of 20 incoming mail test by Microsoft Connectivity Analyzer fail with this PRX5 error.
    Most people don't ever notice the issue because remote mail servers retry the connection later.  However, telephone voice mail systems that forward voice message files to email, or other such applications such as your scanner, often don't retry and
    simply fail.  Our phone system actually disables all further attempts to send voice mail to a particular user if the PRX5 error is returned when the email is sent by the phone system.
    Is Microsoft totally oblivious to this problem?
    PRX5 is a serious issue that needs an Exchange team resolution, or at least an acknowledgement that the problem actually does exist and has negative consequences for proper mail flow.
    JSB

  • HT1420 How can I change my Apple ID email for an account with 100s of purchases to the email address I have that (at some point) I logged into gamecenter and "claimed" it as another person?

    ^---topic
    I have used a @yahoo email address for 10 years as my apple ID when purchasing things.  The biggest problem being, that at some point, yahoo decided to delete the email account and I can't use it.  I would like to use my email addresses that I actually use (@me, @gmail), but I guess I used them at some point to log into gamecenter or some other useless apple thing. I know you can change the email associated with your account, but apple is showing that my emails are already in use, so I can't use them for this purpose.

    Change the email you used in "gamecenter or some other useless apple thing" then change your AppleID.

  • Creative Cloud is telling me "Unable to reach Adobe servers. Please check your firewall settings, and try again in a few minutes.

    Creative Cloud is telling me "Unable to reach Adobe servers. Please check your firewall settings, and try again in a few minutes.
    What do I do to access the cloud? I have checked my firewall settings to allow for me to be able to use adobe cloud. Any Suggestions?

    Try a different browser and/or turn your firewall off to download
    or
    A chat session where an agent may remotely look inside your computer may help
    Creative Cloud chat support (all Creative Cloud customer service issues)
    http://helpx.adobe.com/x-productkb/global/service-ccm.html

Maybe you are looking for