topic Re: 2 questions regardins Logs in Firewall and Security Management

2 questions regardins Logs

Foranator — Fri, 09 Jul 2021 13:57:30 GMT

I have 2 questions in regards to logs.

We are currently using 'Log Exporter' to send logs to our SIEM.

We are seeing 2 weird behaviors :

1. We are getting plenty of "Log Update".
Where is the option to "aggregate logs before sending" ? Is it in the "log exporter" command line or somewhere in the Gateway Console ?
Also, will this option consume a lot of ressources ?

2. We are not seeing any logs from Threat Prevention blades
Is it a "log exporter" problem? We are not filtering "in or out" anything... Could it be that our Checkpoint admin are not tracking anything done in those blades ?

I'm new to checkpoint, so ELI5 🙂

Regards,

Foranator

Re: 2 questions regardins Logs

PhoneBoy — Fri, 09 Jul 2021 15:50:10 GMT

We send updates every 10 minutes or so on Active sessions and, to my knowledge, don’t have an option to change it.
If you’re not getting Threat Prevention logs as part of Log Exporter and you’re doing no filtering, then it’s because those blades are either not enabled or they aren’t logging anything.

Re: 2 questions regardins Logs

Foranator — Fri, 09 Jul 2021 17:02:48 GMT

Could it be that the "tracking" is not activated for those blades ?

https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_LoggingAndMonitoring_AdminGuide/Topics-LMG/Tracking-Options.htm?tocpath=Logging%7CWorking%20with%20Logs%7C_____3