topic Re: Geo Location Log Entries in Firewall and Security Management

Geo Location Log Entries

n3ts3c_auto — Mon, 16 Oct 2023 19:24:45 GMT

Have an installation where the Geo Location CSV file has not updated since the 29 Sept 2023. While troubleshooting, found that the geod daemon is not running. I am wondering what log file I would look at to see why this daemon did not start.

Already looked at the /var/log/messages files and did not find anything. Last reboot was less than 4 days ago.

Re: Geo Location Log Entries

PhoneBoy — Mon, 16 Oct 2023 22:31:19 GMT

What version/JHF?

Re: Geo Location Log Entries

n3ts3c_auto — Mon, 16 Oct 2023 22:48:09 GMT

R81.10 HFA109

Re: Geo Location Log Entries

the_rock — Mon, 16 Oct 2023 22:54:50 GMT

Can you please copy the file location and its name? I can check latest R81.20 code with jumbo 26

Andy

Re: Geo Location Log Entries

n3ts3c_auto — Mon, 16 Oct 2023 23:54:26 GMT

The request was for what log file the geod daemon logs its entries in R81.10. It is listed in sk92823.

Re: Geo Location Log Entries

n3ts3c_auto — Wed, 18 Oct 2023 22:26:11 GMT

Does anyone here have any information on how the Geo Location works? need to know both the Legacy and the new updatable objects.

Re: Geo Location Log Entries

the_rock — Wed, 18 Oct 2023 23:24:39 GMT

Im not aware of any guides or documents for geo location, never seen it, but maybe someone else has. Below is all I can refer to.

https://support.checkpoint.com/results/sk/sk126172

Re: Geo Location Log Entries

n3ts3c_auto — Thu, 19 Oct 2023 00:39:16 GMT

Found this listing in CheckMates:

https://community.checkpoint.com/t5/API-CLI-Discussion/One-liner-to-update-IpToCountry-data-on-Security-Managements/td-p/97922

It mentions:

PRJ-36199

Logging

UPDATE: Mapping of IPs to country/flag is now automatically updated every day. These are visible in the Logs and Events views.

However it does not mention which log (Audit Logs or Logs) where it can be found.

Re: Geo Location Log Entries

n3ts3c_auto — Thu, 19 Oct 2023 00:49:14 GMT

Thank you for the link and TAC has already sent this to me. However this still does not tell me where the geolocation update log entries are and that is the ask.

Re: Geo Location Log Entries

the_rock — Thu, 19 Oct 2023 01:43:23 GMT

Sorry mate, Im not good as BS-ing people, so here is my answer...I HAVE NO CLUE lol

Anyway, if you find out, let us know the answer. I checked my R81.20 labs, but cant locate such logs anywhere, but will keep looking.

Kind regards,

Andy

Re: Geo Location Log Entries

PhoneBoy — Thu, 19 Oct 2023 19:39:28 GMT

$FWDIR/log/geod.elg
See also: https://support.checkpoint.com/results/sk/sk102329

Re: Geo Location Log Entries

PhoneBoy — Fri, 20 Oct 2023 23:25:12 GMT

I don't even find the in.geod binary in R81.20 in $FWDIR/bin (where I'd expect to find it).
Which means it may not even be relevant any longer and a different mechanism is used.
Unfortunately, I do not know what that is and recommend continuing to pursue the issue with TAC.

Re: Geo Location Log Entries

the_rock — Fri, 20 Oct 2023 23:30:30 GMT

I actually checked 7 of my lab gateways, all on latest jumbo R81.20 and none of them had any geod.elg files, same with mgmt server.

Andy