Thursday, January 15, 2015

Check Point: "Read-only file system" "cannot create regular file" / Cant Write To External 2T Hard Drive

I have been getting prepared to do an upgrade of a Check Point management station to R77.20.  One of the things I am getting ready to do is to move the log files over to an external hard drive, so that we can import them back in and no logs are lost.  Ill do the migrate import in after I do a fresh install of R77.20 on the new management station.  Then Ill import in the logs so that no logs are lost.
One problem I have run into is when I connect the 2T byte drive in the USB connection, I can mount the drive just fine, and read it contents.  However, I can not write to it.  On read access is available.  This drive is formatted via NTFS.
After a while of trying to figure this out, it turns out that I have to have some other install package (Fuse, I think) to make it work.  Well, I dont want to do that on my Check Point management station, or any enforcement module for that matter.  So, I formatted my 2T drive to be exFAT instead.  This seems to have worked for me.  I can now write to this drive.
Here are some things that I ran into that you might recognize if you are running into this issue:
One of the error messages I got when trying to write to the external drive:
cp: cannot create regular file `/usb-storage/2014-10-01_235900.logptr': Read-only file system

[Expert@CP:0]# cat /proc/mounts
...
/dev/sdb1 /usb-storage ntfs ro,uid=0,gid=0,fmask=0177,dmask=077,nls=utf8,errors=continue,mft_zone_multiplier=1 0 0

Notice the RO on the mounted drive above.
So now I have found a SK on Check Point that actually looks like is the fix.  Its SK61081.  Here is what I did in CLI.

[Expert@CP1:0]# cat /proc/partitions
major minor  #blocks  name

   8     0  245175336 sda
   8     1     305203 sda1
   8     2   10514542 sda2
   8     3  234348187 sda3
 253     0   33554432 dm-0
 253     1    5242880 dm-1
 253     2    1048576 dm-2
 253     3   62914560 dm-3
 253     4    6127616 dm-4
   8    16 1953481728 sdb
   8    17 1953480704 sdb1

[Expert@CP1:0]# parted sdb1
Error: Could not stat device sdb1 - No such file or directory.
Retry/Cancel? cancel
[Expert@CP1:0]# parted /dev/sdb1
GNU Parted 1.8.1
Using /dev/sdb1
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) mklabel gpt
(parted) print

Model: Unknown (unknown)
Disk /dev/sdb1: 2000GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number  Start  End  Size  File system  Name  Flags

(parted) mkpart primary 0.000 2000000.000
(parted) print

Model: Unknown (unknown)
Disk /dev/sdb1: 2000GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number  Start   End     Size    File system  Name     Flags
 1      17.4kB  2000GB  2000GB               primary

(parted) quit
[Expert@CP1:0]# mkfs -t ext3 /dev/sdb1
mke2fs 1.39 (29-May-2006)
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
244187136 inodes, 488370176 blocks
24418508 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=0
14904 block groups
32768 blocks per group, 32768 fragments per group
16384 inodes per group
Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
        4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968,
        102400000, 214990848

Writing inode tables: done
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 30 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.
[Expert@CP1:0]# mount -t ext3 /dev/sdb1 /usb-storage
[Expert@CP1:0]# mount
/dev/mapper/vg_splat-lv_current on / type ext3 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/sda1 on /boot type ext3 (rw)
tmpfs on /dev/shm type tmpfs (rw)
/dev/mapper/vg_splat-lv_log on /var/log type ext3 (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
/dev/sdb1 on /usb-storage type ext3 (rw)   <--- Notice it says (rw) now!
[Expert@CP1:0]#
[Expert@CP1:0]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current
                       31G  5.8G   24G  20% /
/dev/sda1             289M   64M  211M  24% /boot
tmpfs                 2.0G     0  2.0G   0% /dev/shm
/dev/mapper/vg_splat-lv_log
                       59G  4.6G   51G   9% /var/log
/dev/sdb1             1.8T  196M  1.7T   1% /usb-storage

Finally got this working.  

1 comment:

  1. Wow...great write-up!! And some great digging to get this to work! I like Check Point firewalls, but have not worked with them in many years...way back when they only ran on Sun Solaris servers. (I miss those days!) Thanks Shane!!

    ReplyDelete

Your comment will be reviewed for approval. Thank you for submitting your comments.