topic Re: What is best practice for syslog sending in Firewall and Security Management

What is best practice for syslog sending

TSOL — Wed, 01 Feb 2023 08:23:09 GMT

Dear Team,

Hello.

We are setting a distributed environment with two smart-1 appliances(MGMT-HA) and two quantum appliances(Cluster_XL).

We need to send syslog to other syslog server.

In this case, should I configure Gaia or Smartconsole to send syslogs?

And I want to know the difference between syslog that can be sent from Gaia and syslog that can be sent from smartconsole.

Please let me know if you have any information.

Re: What is best practice for syslog sending

Chris_Atkinson — Wed, 01 Feb 2023 08:39:10 GMT

Regarding Syslog for Security & Audit Logs the answer is:

sk122323: Log Exporter - Check Point Log Export

Weather you configure it in GAiA CLI or SmartConsole depends on the Management version & advanced nature of the config required.

The Syslog otherwise configured at the GAiA level is the system/OS logs as different to the above.

Re: What is best practice for syslog sending

TSOL — Wed, 01 Feb 2023 08:58:48 GMT

Thank you for the reply.

This SK is set to send syslog from smartconsole, but is checkpoint recommended to send it from smartconsole normally?
Gaia can also send syslogs, but when would you use this?

Please let me know if you have any information.

Re: What is best practice for syslog sending

Chris_Atkinson — Wed, 01 Feb 2023 12:06:12 GMT

As above security logs come from management.

Local OS events direct from the Gateway.

Re: What is best practice for syslog sending

George_Ellis — Wed, 01 Feb 2023 14:19:41 GMT

You would use it in Info level if you wanted to see DHCP assignments if the gateway is set to act as a DHCP server. You can also scrub for local logins, and any critical or warnings you specifically need. With PCI-DSS, sending these to your syslog servers allows better validation of their questions. It is very satisfying during an audit to say, "Did you check on the syslog infrastructure? It is there."