topic Re: Checking Logs from the CP CLI in Firewall and Security Management

Checking Logs from the CP CLI

Matlu — Tue, 18 Mar 2025 04:20:37 GMT

Hello, Guys.

Is it possible to see the traffic logs through the CLI of a FW, and not from the SmartConsole?

I want to see the traffic of a flow, for the last 7 days, at the moment of executing the command (if possible).

SOURCE IP: 192.168.59.180
IP DESTINATION: 10.100.100.5
Service: 88
Days: Last Week

If it is possible to print the log in the CLI, could you please share the syntax with an example?

I don't have access now to the SmartConsole, so I want to try to see if there are relevant logs, standing on the same FW.

Greetings.

Re: Checking Logs from the CP CLI

emmap — Tue, 18 Mar 2025 05:25:10 GMT

The logs aren't stored on the gateways*, they get generated and sent to the log servers. There is an API available for pulling logs from the log server that you can use from its CLI.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_LoggingAndMonitoring_AdminGuide/Content/Topics-LMG/API-for-Logs.htm

*Unless the log server is offline.

Re: Checking Logs from the CP CLI

HeikoAnkenbrand — Tue, 18 Mar 2025 08:02:00 GMT

Hi @Matlu,

you can use the following command:

fw log -l -b "June 12, 2024 12:33:00" "June 12, 2024 15:34:00" | grep <IP or other parameter>

or the management API (Management API Reference) - here is an example:

mgmt_cli show logs new-query.time-frame "today" new-query.max-logs-per-request "2" new-query.filter "blade:Threat Emulation"  --format json

In both cases, you still need to adjust your filters.

Re: Checking Logs from the CP CLI

Matlu — Tue, 18 Mar 2025 11:56:06 GMT

Hi,

The command #fw log....... command, can it be executed in the same GW?
Or is it only executed in the SMS?

How can you be sure if the GW is really generating logs?

Greetings.

Re: Checking Logs from the CP CLI

Lloyd_Braun — Tue, 18 Mar 2025 13:00:33 GMT

cpstat fw -f log_connection will show if you're connected to the log server and how many logs you're sending.

you used to be able to run 'fw log -flnt' on the gateway to dump fw.log file to stdout and "tail" it for new logs. not sure if this still works, or may only work if you are disconnected from the log server so the firewall is logging locally.

Re: Checking Logs from the CP CLI

PhoneBoy — Wed, 19 Mar 2025 00:09:50 GMT

fw log is executed where the logs are stored (not the gateway unless the connection to management/log server is down).
The cpstat command @Lloyd_Braun should tell you what you want.

Re: Checking Logs from the CP CLI

the_rock — Wed, 19 Mar 2025 00:37:41 GMT

@HeikoAnkenbrand gave the best option, in my opinion.

Otherwise, you can check /var/log/messages files or $FWDIT/log/fw.log file

Andy