migrate_server

Important - This command is used to migrate the management database from R80.20.M1, R80.20, R80.20.M2, R80.30, and higher versions.

For more information, see:

Description

Exports the management database and applicable Check Point configuration.

Imports the exported management database and applicable Check Point configuration.

Backing up and restoring in Management High Availability environment:

For more information:

Notes:

  • You must run this command from the Expert mode.

  • If it is necessary to back up the current management database, and you do not plan to import it on a Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. that runs a higher software version, then you can use the built-in command in the $FWDIR/scripts/ directory.

  • If you plan to import the management database on a Management Server that runs a higher software version, then you must use the migrate_server utility from the migration tools package created specifically for that higher software version. See the Installation and Upgrade Guide for that higher software version.

  • If this command completes successfully, it creates this log file:

    /var/log/opt/CPshrd-R82.10/migrate-<YYYY.MM.DD_HH.MM.SS>.log

    For example: /var/log/opt/CPshrd-R82.10/migrate-2022.06.14_11.03.46.log

  • If this command fails, it creates this log file:

    $CPDIR/log/migrate-<YYYY.MM.DD_HH.MM.SS>.log

    For example: /opt/CPshrd-R82.10/log/migrate-2025 - 2026.06.14_11.21.39.log

Important - If it is necessary to back up the current management database, and you do not plan to import it on a Management Server that runs a higher software version, then you must make sure the source Management Server and the target Management Server run the same Jumbo Hotfix AccumulatorClosed Collection of hotfixes combined into a single package. Acronyms: JHA, JHF, JHFA. Take and all other private hotfixes.

To see all the installed software packages, you can run this command: cpinfo -y all

Syntax

  • To see the built-in help:

    [Expert@MGMT:0]# cd $FWDIR/scripts/

    [Expert@MGMT:0]# ./migrate_server -h

  • To see the build number of the installed Upgrade Tools package:

    [Expert@MGMT:0]# cd $FWDIR/scripts/

    [Expert@MGMT:0]# ./migrate_server print_installed_tools -v R82.10

  • To run the Pre-Upgrade Verifier:

    [Expert@MGMT:0]# cd $FWDIR/scripts/

    [Expert@MGMT:0]# ./migrate_server verify -v R82.10 [-skip_upgrade_tools_check]

  • To export the management database and configuration:

    [Expert@MGMT:0]# cd $FWDIR/scripts/

    [Expert@MGMT:0]# ./migrate_server export -v R82.10 [-skip_upgrade_tools_check] [-l | -x] [--include-uepm-msi-files] [--exclude-uepm-postgres-db] [--ignore_warnings] /<Full Path>/<Name of Exported File>

  • To import the management database and configuration:

    [Expert@MGMT:0]# cd $FWDIR/scripts/

    [Expert@MGMT:0]# ./migrate_server import -v R82.10 [-skip_upgrade_tools_check] [-l | -x] [/var/log/mdss.json] [--include-uepm-msi-files] [--exclude-uepm-postgres-db] /<Full Path>/<Name of Exported File>.tgz

  • To import the Domain Management Server database and configuration on a Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server.:

    [Expert@MGMT:0]# cd $FWDIR/scripts/

    [Expert@MGMT:0]# ./migrate_server migrate_import_domain -v R82.10 [-skip_upgrade_tools_check] [-l | -x] [/var/log/mdss.json] [--include-uepm-msi-files] [--exclude-uepm-postgres-db] /<Full Path>/<Name of Exported File>.tgz

Parameters

Parameter

Description

-h

Shows the built-in help.

print_installed_tools -v R82.10

Shows the build number of the installed Upgrade Tools package.

--verify_all_servers

Runs the Pre-Export Verifier for all Management Servers and Log Servers in your environment.

Notes:

Note - Servers that are configured on a specific Domain on a Multi-Domain Security Management Server will be verified only if there is a Domain Server of that Domain on the current Multi-Domain Security Management Server.

--verify_local_only

Runs the Pre-Export Verifier only for the current Management Server / Log Server, on which you run this command.

Note - This parameter is valid only for the "migrate_server verify" and "migrate_server export operations.

"

-skip_tools_check_on_remote

The remote Management Server / Log Servers do not try to connect to Check Point Cloud to check for a more recent version of the Upgrade Tools.

Notes:

  • This parameter is valid only for the "migrate_server verify" and "migrate_server export" operations.

  • This parameter is valid only when you specify the parameter "--verify_all_servers".

export

Exports the management database and applicable Check Point configuration.

import

Imports the management database and applicable Check Point configuration that were exported from another Management Server.

Important:

  • This command automatically restarts Check Point services (runs the "cpstop" and "cpstart" commands).

  • This note applies to a Multi-Domain Security Management environment, if at least one of the servers changes its IPv4 address comparing to the source server, from which you exported its database.

    You must do these steps before you start the upgrade and import:

    1. You must create a special JSON configuration file with the new IPv4 address(es).

      Syntax:

      [{"name":"<Name of Server 1 Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Server 1>"},

      {"name":"<Name of Server 2 Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Server 2>"}]

      Example:

      [{"name":"MyPrimaryMultiDomainServer","newIpAddress4":"172.30.40.51"},{"name":"MySecondaryMultiDomainServer","newIpAddress4":"172.30.40.52"}]

    2. You must call this file: mdss.json

    3. You must put this file on all servers in this directory: /var/log/

migrate_import_domain

On a Security Management Server, imports the management database and applicable Check Point configuration that were exported from a Domain Management Server.

Important - This command automatically restarts Check Point services (runs the "cpstop" and "cpstart" commands).

verify

Verifies the management database and applicable Check Point configuration that were exported from another Management Server.

-v R82.10

Specifies the version, to which you plan to migrate / upgrade.

-skip_upgrade_tools_check

The current Management Server / Log Server, on which you run this command, does not try to connect to Check Point Cloud to check for a more recent version of the Upgrade Tools.

Best Practice - Use this parameter on the Management Server / Log Server that is not connected to the Internet.

-l

Exports and imports the Check Point logs without log indexes in the $FWDIR/log/ directory.

Important:

  • The command can export only closed logs (to which the information is not currently written).

  • If you use this parameter, it can take the command a long time to complete (depends on the number of logs).

-l <Days>

Exports the specified number of previous days of logs without log indexes.

-x

Exports and imports the Check Point logs with their log indexes in the $FWDIR/log/ directory.

Important:

  • Before you use this parameter, it is necessary to make sure all log indexes are closed and saved.

    Run this command in the Expert mode and wait for the output to show "Solr stopped":

    $RTDIR/scripts/stopSolr.sh

  • This parameter only supports Management Servers and Log Servers R80.10 and higher.

  • The command can export only closed logs (to which the information is not currently written).

  • If you use this parameter, it can take the command a long time to complete (depends on the number of logs and indexes).

-x <Days>

Exports the specified number of previous days of logs with log indexes.

-n

Runs silently (non-interactive mode) and uses the default options for each setting.

/var/log/mdss.json

 

Previously:

-change_ips_file /<Full Path>/<Name>.json

Important:

  • In the Upgrade Tools for R81.10 build higher than 996000356, the syntax is (this filename is mandatory):

    /var/log/mdss.json

    You must create the file /var/log/mdss.json and not use the parameter "-change_ips_file".

  • In the Upgrade Tools for R81.10 build 996000356 and lower, the syntax was:

    -change_ips_file /<Full Path>/<Name of JSON File>.json

Specifies the absolute path to the special JSON configuration file with new IPv4 addresses.

This file is mandatory during an upgrade of a Multi-Domain Security Management environment.

Even if only one of the servers migrates to a new IP address, all the other servers must get this configuration file for the import process.

Syntax:

[{"name":"<Name of Server 1 Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Server 1>"},

{"name":"<Name of Server 2 Object in SmartConsole>","newIpAddress4":"<New IPv4 Address of Server 2>"}]

Example:

[{"name":"MyPrimaryMultiDomainServer","newIpAddress4":"172.30.40.51"},

{"name":"MySecondaryMultiDomainServer","newIpAddress4":"172.30.40.52"}]

--include-uepm-msi-files

  • During the export operation, backs up the MSI files from the Endpoint Security Management Server.

  • During the import operation, restores the MSI files on the Endpoint Security Management Server.

--exclude-uepm-postgres-db

  • During the export operation, does not back up the PostgreSQL database from the Endpoint Security Management Server.

  • During the import operation, does not restore the PostgreSQL database on the Endpoint Security Management Server.

--ignore_warnings

or

-ivw

If during an upgrade procedure, the Pre-Upgrade Verifier shows warnings, you can use this parameter to ignore warnings and continue the upgrade.

Important - To prevent issues during and after upgrade, we strongly recommend to resolve all issues and not use this parameter.

--exclude-licenses

  • During the export operation, does not back up the licenses from the Management Server.

  • During the import operation, does not restore the license on the Management Server.

-complete

Completes upgrade.

Note - This option is valid for import and export modes only.

-force-upgrade-flow

When the source and target servers are on the same major version,

"migrate_server" uses an accelerated flow to migrate the data.

This flag forces the full migration flow.

-mask

Hides sensitive information in exported database.

--no_progress_bar

or

-npb

Disable the progress bar.

-prepare_background

Prepares upgrade in background.

-cancel_prepare

Cancels upgrade preparation.

-grace_period <Minutes>

Grace period before starting upgrade completion.

-o <Path to File>

Path to the archived file from which to import the database.

-sn <Name of Domain Server>

Name of the Domain Management Server.

-dsi <IP address of Domain Server>

IP address of the Management Server.

-skip_logs

Skip the import of logs (without log indexes).

Example 1 - Export operation succeeded

[Expert@MGMT:0]# cd $FWDIR/scripts/
[Expert@MGMT:0]# ./migrate_server export -v R82.10 /var/log/Migrate_Export
 
You are required to close all clients to Security Management Server
or execute 'cpstop' before the Export operation begins.
 
Do you want to continue? (y/n) [n]? y
 
 
Copying required files...
Compressing files...
 
The operation completed successfully.
 
Location of archive with exported database: /var/log/Migrate_Export.tgz
 
[Expert@MGMT:0]#
[Expert@MGMT:0]# find / -name migrate-\* -type f
/var/log/opt/CPshrd-R82.10/migrate-2025 - 2026.06.14_11.03.46.log
[Expert@MGMT:0]#

Example 2 - Export operation failed

[Expert@MGMT:0]# ./migrate_server export /var/log/My_Migrate_Export
Execution finished with errors. See log file '/opt/CPshrd-R82.10/log/migrate-2025 - 2026.06.14_11.21.39.log' for further details
[Expert@MGMT:0]#