topic Re: Smartlog Vs SmartEvent in Firewall and Security Management

Smartlog Vs SmartEvent

leangm — Thu, 28 Jul 2022 13:56:38 GMT

Hello Checkmate

I have one question related dedicated logs server and the dedicated smart event server

What is the best practice to configure log settings from the gateway send to dedicate logs server and dedicate smart event server?

Example:

1 Security Management VM

1 VM Smartlog Server

1 VM SmartEvent

Re: Smartlog Vs SmartEvent

G_W_Albrecht — Thu, 28 Jul 2022 14:17:10 GMT

SmartEvent gets its logs from Log Server, see https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_LoggingAndMonitoring_AdminGuide/Topics-LMG/Understanding-Logging.htm?tocpath=Getting%20Started%7C_____2

Re: Smartlog Vs SmartEvent

Chris_Atkinson — Thu, 28 Jul 2022 14:24:56 GMT

The above looks as expected, you can optionally set the mgmt as a backup log server if you choose.

Re: Smartlog Vs SmartEvent

leangm — Fri, 29 Jul 2022 09:41:47 GMT

still not clear about this link

My question is if we have a separate VM server let say

1VM running as Smart event server and other 1VM functions running as a log server

How do we get logs from the gateway?

Re: Smartlog Vs SmartEvent

G_W_Albrecht — Fri, 29 Jul 2022 10:27:30 GMT

GW sends logs to log server. SmartEvent pulls the events from log server to correlate and store them. Using SmartConsole, you connect to SMS to see or save SmartLogs, Events and Reports.

Re: Smartlog Vs SmartEvent

leangm — Fri, 29 Jul 2022 10:42:08 GMT

So mean we no need to configure the gateway setting to send logs to smartvent server? send to only log server ok?

and could I know what is the benefit to deploy a dedicated smartvent server?

Re: Smartlog Vs SmartEvent

Chris_Atkinson — Fri, 29 Jul 2022 10:51:52 GMT

No. You don't need to configure it on the Gateway.

You would only do this If you wanted the SmartEvent server to be a last resort backup in case the log server was unavailable.

Performance and scalability. Most customers typically start with Mgmt & SmartEvent, sizing determines if they are the same machine or separate.

Dedicated log servers might also be for retention or performance reasons. In a basic deployment the Mgmt also serves as a log server.

Re: Smartlog Vs SmartEvent

leangm — Fri, 29 Jul 2022 11:35:04 GMT

One more question:

If we have a SIEM solution and want to export logs to SIEM should we export on both servers and do you have any document best practices to export log servers to SIEM?

Log server machine

and Smarteevent server machine

Re: Smartlog Vs SmartEvent

Chris_Atkinson — Fri, 29 Jul 2022 11:59:34 GMT

Log Exporter is used here, see sk122323 and the relevant admin guides to configure the export from the Log server. In recent versions this can be done via SmartConsole.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitoring_AdminGuide/Topics-LMG/Log-Exporter.htm

Re: Smartlog Vs SmartEvent

Amir_Senn — Sun, 31 Jul 2022 11:46:49 GMT

In order to export all the traffic logs you need to define it on the log server.

If you want it to export correlated events you need to define it for the SmartEvent server as well.