topic Re: Logging for GAIA portal and SSH access in Firewall & Security Management

Logging for GAIA portal and SSH access

Joe_Kanaszka — Tue, 24 Mar 2026 08:45:15 GMT

Good morning!

We are currently logging admin access to Smart Console via the Check Point Audit logs.

How can we monitor access to the GAIA portal and SSH access to the firewalls?

Shouldn't this show up in the audit logs as well?

Thanks guys for any assistance.

Re: Logging for GAIA portal and SSH access

simonemantovani — Tue, 24 Mar 2026 08:50:05 GMT

Did you check this from the admin guide?

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/System-Logging-Gaia-Portal.htm?Highlight=log

Re: Logging for GAIA portal and SSH access

Lesley — Tue, 24 Mar 2026 09:23:57 GMT

This or as alternative a playbook

Re: Logging for GAIA portal and SSH access

Joe_Kanaszka — Tue, 24 Mar 2026 11:48:05 GMT

Thank you. Can we simply see GAIA and SSH activity in the Audit logs? One "pane of glass" so to speak?

Re: Logging for GAIA portal and SSH access

Joe_Kanaszka — Tue, 24 Mar 2026 11:48:38 GMT

Thank you! I'll ask you the same thing: Can we simply see GAIA and SSH activity in the Audit logs? One "pane of glass" so to speak?

Re: Logging for GAIA portal and SSH access

simonemantovani — Tue, 24 Mar 2026 12:24:32 GMT

Yes it is possibile.

I attached a screenshot of the log taken from the Smartconsole for ssh access.

Re: Logging for GAIA portal and SSH access

Lesley — Tue, 24 Mar 2026 12:27:58 GMT

https://support.checkpoint.com/results/sk/sk181230

Also, check the ''audit'' log tab in Smart Console, you can make smart event reports or view with this based on the log info.

Here is an example of logged web interface log action

Re: Logging for GAIA portal and SSH access

Joe_Kanaszka — Tue, 24 Mar 2026 12:38:57 GMT

Thank you! I found a post from last March:

https://community.checkpoint.com/t5/General-Topics/Gateway-secure-log-Can-these-be-seen-in-Smart-Console/td-p/243084

Is this what you're configuring?

In our case, I'd like to capture SSH to the gateways, whether it be clish or Bash. I would also like to capture admin access to the GAIA portal itself.

Is this all done through configuring syslog on the gateways and pointing the syslogs to our SMS/log server?

Thank you again!

Re: Logging for GAIA portal and SSH access

simonemantovani — Tue, 24 Mar 2026 15:53:55 GMT

If you follow the admin guide, the firewall will send audit logs directly to the management.

set syslog cplogs on

set syslog mgmtauditlogs on

set syslog auditlog permanent

Re: Logging for GAIA portal and SSH access

Joe_Kanaszka — Tue, 24 Mar 2026 17:54:58 GMT

Thank you! Question. What is the difference between your sk and sk102995?

https://support.checkpoint.com/results/sk/sk102995

Re: Logging for GAIA portal and SSH access

simonemantovani — Tue, 24 Mar 2026 17:58:04 GMT

it's the same (I made reference to the admin guide), the SK 102995 also includes commands to send logs to a 3rd party server.

Re: Logging for GAIA portal and SSH access

the_rock — Tue, 24 Mar 2026 18:21:56 GMT

Hey brother,

How you been, all good? I checked what @simonemantovani and @Lesley both said and it makes perfect logical sense. I know both options work as I tested them before.

Re: Logging for GAIA portal and SSH access

Joe_Kanaszka — Tue, 24 Mar 2026 19:33:13 GMT

Gotcha. OK. Question if you have time. The admin guide leaves out the part that sk 102995 references about making the second change in Smart Console under Logs -> Additional logging configuration and selecting "Accept Syslog messages".

Am I missing something?

Re: Logging for GAIA portal and SSH access

the_rock — Tue, 24 Mar 2026 19:41:54 GMT

Im fairly positive that option should be checked, brother.

Re: Logging for GAIA portal and SSH access

Joe_Kanaszka — Tue, 24 Mar 2026 20:00:24 GMT

No I agree. 🙂 It's just strange how the admin guide doesn't mention it.

Re: Logging for GAIA portal and SSH access

the_rock — Tue, 24 Mar 2026 20:22:56 GMT

I know, mind you, truth be told, lots of guides for various vendors may not mention things like that : - (

Thanks God for communities like this one!

Re: Logging for GAIA portal and SSH access

the_rock — Tue, 24 Mar 2026 20:36:05 GMT

Hey Joe,

I know even this screenshot from help section show2s pretty basic explanation, but it does what @simonemantovani mentioned.

Re: Logging for GAIA portal and SSH access

Joe_Kanaszka — Tue, 24 Mar 2026 20:41:05 GMT

Yep - makes sense. Thanks Andy!

Re: Logging for GAIA portal and SSH access

the_rock — Tue, 24 Mar 2026 21:00:03 GMT

Always glad we can help!