topic Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs in Firewall and Security Management

GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

Checkmate_000 — Fri, 09 May 2025 12:49:42 GMT

Team,

We are currently unable to see any login logs related to the GAIA WebUI (portal) of the Management Server in the SmartConsole audit logs. However, login entries for both SSH access and SmartConsole access are appearing in audit logs.

Could you please advise on why GAIA WebUI login attempts are not being recorded in the audit logs?

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

the_rock — Fri, 09 May 2025 15:29:46 GMT

Can you search by IP itself in audit logs? Thats what I did and showed up.

Andy

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

the_rock — Fri, 09 May 2025 15:51:20 GMT

This is what I meant in my first response.

Andy

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

Checkmate_000 — Mon, 12 May 2025 10:56:59 GMT

Dear Team,

I have checked the audit logs for various customers by searching with the IP address; however, we are unable to find any logs related to WebUI logins. Could you please confirm if there are any specific settings that need to be enabled in order to capture WebUI login logs?

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

the_rock — Mon, 12 May 2025 11:28:46 GMT

Check my screenshot. Its my mgmt IP address.

Andy

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

Duane_Toler — Wed, 14 May 2025 03:18:32 GMT

Check your Gaia WebUI syslog settings. There's an option to send this to the Audit Log.

CLISH:

> show syslog mgmtauditlogs Sending audit logs to Management Serever is enabled

(apparently the typo is real... not my doing)

Enable it with:

set syslog mgmtauditlogs on show syslog mgmtauditlogs

This is described in the Gaia Admin documentation

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Gaia_AdminGuide/Content/Topics-GAG/System-Logging-Gaia-Clish.htm?tocpath=System%20Management%7CSystem%20Logging%7C_____2

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

Tal_Paz-Fridman — Wed, 14 May 2025 05:33:40 GMT

Following what Duane wrote you can also check the settings in Gaia Portal

It should produce this log:

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

Checkmate_000 — Wed, 14 May 2025 05:48:55 GMT

Dear Team,

"The setting has already been enabled, but we are still unable to see the audit logs for WebUI logins. This issue is not limited to a specific customer I have verified it across three different customers' Check Point Management Servers. In all cases, the setting is enabled, but WebUI login events are not appearing in the audit logs even if I'm searching with the Mgmt server IP.

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

Checkmate_000 — Wed, 14 May 2025 06:32:59 GMT

I have checked using the Management IP, but I'm still unable to see any audit logs for WebUI logins. Additionally, I noticed that this is not only to the Management Server—WebUI access logs for the firewall itself are also missing from the audit logs.

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

Tal_Paz-Fridman — Wed, 14 May 2025 06:48:20 GMT

Thanks @Duane_Toler - I will move the typo issue to R&D owner to be fixed

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

G_W_Albrecht — Wed, 14 May 2025 07:40:00 GMT

Please open SR# with CP TAC to get this resolved asap !

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

Dan_Manley — Thu, 22 May 2025 20:48:11 GMT

Would you please post your fix when you get it as we have the same issue. R81.20

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

G_W_Albrecht — Fri, 23 May 2025 07:51:40 GMT

If CP gives a configuration hint his could be posted - but any HF has to be verified using customers cpinfo/migrate export to stay under support. You have to contact TAC to get the HF.

Re: GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

mrbhenry — Thu, 02 Apr 2026 16:49:52 GMT

Hi Checkmate_00 -

Did you ever open SR# with CP TAC and get this resolved? We are experiencing the same behavior.