topic Re: [Issue] R80.10 SmartConsole: Export Logs to CSV in Firewall and Security Management

[Issue] R80.10 SmartConsole: Export Logs to CSV

Young_Wook_Choi — Wed, 23 Aug 2017 08:21:02 GMT

Hi,

In SmartConsole, I want to export logs to CSV for some period. (For example, 30 days)

I applied the filter(30 days) and export it to a CSV file.

However, the log of 30 days was not exported and only a part was exported.

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

PhoneBoy — Thu, 24 Aug 2017 00:10:15 GMT

It will only export the records currently visible.

This is a known limitation that I believe is planned to be addressed in future releases.

SmartView (available at https://management-ip/smartview) will export up to a million records if I recall.

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

Young_Wook_Choi — Thu, 24 Aug 2017 01:59:59 GMT

Thanks for your update.

When will this limitation be resolved? Will it be resolved in the next version? (Such as R80.20 or R80.30)

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

Kfir_Dadosh — Thu, 24 Aug 2017 14:59:21 GMT

Sure, it is in our roadmap and will be added in future versions.

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

PhoneBoy — Thu, 24 Aug 2017 16:02:52 GMT

Exact release target has not been finalized.

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

Stuart_Street — Tue, 12 Sep 2017 02:10:59 GMT

I would like to export firewall logs, the Web based SmartView (available at https://management-ip/smartview) does not show the access rule name or number. Is there a way to add these?

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

PhoneBoy — Tue, 12 Sep 2017 05:53:17 GMT

As far as I know there is not, at least in the Log view.

In the reports view, it's possible to create a report that includes the Rule Name.

For me, at least, was not showing the Rule Name.

it, it

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

Stuart_Street — Tue, 12 Sep 2017 07:01:27 GMT

Thanks Dameon,

Is Reports view something that needs to be enabled? I seem to only have "Open Log View" and "Open Audit Log View".

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

PhoneBoy — Tue, 12 Sep 2017 07:12:32 GMT

Click on the plus (far right tab).

From here, you can create a New View:

Specify category Access Control:

Then you can add a widget using the screenshot I showed earlier.

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

Network_generic — Fri, 09 Feb 2018 09:55:40 GMT

Hey Checkpoint,

Is there already a hotfix for this annoying bug available?

The workaround is not a workable solution for policy cleanup!

We used to work with a mgmt station in R80 and migrated last week to MGMT R80.10.

Kr,

Fabio

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

Vladimir — Sat, 10 Feb 2018 21:16:06 GMT

I believe this requires SmartEvent blade and license to function as depicted, else you'll see only the Log View and Audit Log View options.

Can you tell me what befell those who had SmartReporter licence and blade active in R77 after upgrade to R80.10?

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

PhoneBoy — Sat, 10 Feb 2018 22:18:41 GMT

As far as I know, this limitation still exists and does not have an immediate fix.

It is expected to be addressed in a later release, as noted elsewhere in this thread.

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

PhoneBoy — Sat, 10 Feb 2018 22:20:55 GMT

SmartReporter doesn't exist in R80+.

If you only have a license for this and you haven't yet traded in for SmartEvent, you will need to work with your Check Point rep/partner to trade in for a SmartEvent license.

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

Tomer_Sole — Sun, 11 Feb 2018 08:26:55 GMT

what bug?

you can export through https://management-ip/smartview

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

Tomer_Sole — Sun, 11 Feb 2018 08:27:24 GMT

no need for SmartEvent license to export logs.

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

Martin_Visser — Thu, 27 Sep 2018 06:25:57 GMT

I'm not sure if you call it a bug or non-feature. But this doesn't work the way most security engineers expect it to. (I have been through CP support on this). SmartView only reports on what CP has decided is a security event or incident. So when it calculates bandwidth or logs or the like it is only these.

For instance I wanted to be able to report all access (Accept or Drops) to the NTP service. Even though we log each of these, and those logs are sent to the SmartEvent server, SmartView isn't interested in reporting these.

I am interested though, as the security gateway clearly is logging these, and being at the centre of the network, is the most obvious point to instrument from. Very frustrating particularly as we went to the effort of justifying the additional CP licence for this on the basis of the visualisation it could give us.

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

PhoneBoy — Thu, 27 Sep 2018 13:46:06 GMT

The following thread is probably relevant to the conversation:

Re: Creating reports with tracking "per connection"‌

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

Martin_Visser — Thu, 27 Sep 2018 22:51:32 GMT

Thanks Dameon,

It looks relevant, but still doesn't address why the SmartView tool simply misrepresents the operating state of the system. We have been logging pretty much everything that passes through our security gateway (from when it was greenfield 6 months ago, and as we migrated the legacy workloads into the new datacenter environment). We did this so we could analyse the state of the environment to help us close the loop and the security policy and the overall network state of the environment. If the suggestion is to add "Session" logging to everything, well and good, but why isn't this the default (or at least a suggestion) when the SmartEvent server is deployed.

It just is ludicrous when we thousands of NTP logs per hour, yet running SmartView to report on NTP gives nada. It's just not sane defaults.

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

PhoneBoy — Fri, 28 Sep 2018 04:03:04 GMT

From my R80.20.M1 system, this seems to be working as expected.

Even in older releases, I would expect this to work.

You may want to engage the TAC for further troubleshooting.

Re: [Issue] R80.10 SmartConsole: Export Logs to CSV

TheRealDiZ — Mon, 18 Mar 2019 14:16:24 GMT

Hi All,

Anyone knows if this "bug" is actually solved or there is any kind of dedicated fix for R80.10 or included in a specific SmartConsole package?

Ciao e grazie

Diz