topic Newly installed R80.20 gateways do not send logs to the R80.10 log server in Firewall and Security Management

Newly installed R80.20 gateways do not send logs to the R80.10 log server

prisciltetchou — Tue, 30 Jul 2019 12:37:11 GMT

Hello Mates,

We have been introducing R80.20 appliances with the standards configuration.

But they do not send logs to our R80.10 log server.

Can R80.10 log server support R80.20 gateways?

This is the first time I post a question here.

Please let me know if you need more information.

Re: Newly installed R80.20 gateways do not send logs to the R80.10 log server

Daniel_Taney — Tue, 30 Jul 2019 18:35:42 GMT

It's always been my understanding the best practice is to ensure all your Management and Log Servers are running the same or newer version of Check Point software before introducing higher version Gateways into the environment. Is there any particular reason you can't upgrade the log server to R80.20?

Re: Newly installed R80.20 gateways do not send logs to the R80.10 log server

PhoneBoy — Tue, 30 Jul 2019 21:20:56 GMT

Log Server generally must be same or higher version than gateways.
That said I know there are specific patches that enable management of gateways of a higher version.
What version of management in this case?

Re: Newly installed R80.20 gateways do not send logs to the R80.10 log server

rohan_savant — Wed, 31 Jul 2019 01:36:52 GMT

We have r80.10 Management box supporting r80.20 gateways. All features except the Features new to r80.20 work fine including logging and all blades so it is definitely supported as long as you have JHF take 169 or above.

Re: Newly installed R80.20 gateways do not send logs to the R80.10 log server

Maarten_Sjouw — Wed, 31 Jul 2019 06:06:12 GMT

It should work when at least Jumbo 167 has been installed.

Re: Newly installed R80.20 gateways do not send logs to the R80.10 log server

prisciltetchou — Wed, 31 Jul 2019 09:46:24 GMT

This is the version of the management server. It is the same as the log server:

HOTFIX_R80_10_JUMBO_HF Take: 203

Re: Newly installed R80.20 gateways do not send logs to the R80.10 log server

prisciltetchou — Wed, 31 Jul 2019 09:50:34 GMT

We planned to migrate all existing gateway from R77.30 to R80.20.

To simplify our work, we decided to install new gateways in R80.20.

The management server is also in R80.10 and it manages well those R80.20 gateways.

Re: Newly installed R80.20 gateways do not send logs to the R80.10 log server

_Val_ — Wed, 31 Jul 2019 10:15:10 GMT

Did you install database on your log server after setting up R80.20 gateways? I suspect the logs are sent, but not shown/indexed

Re: Newly installed R80.20 gateways do not send logs to the R80.10 log server

prisciltetchou — Wed, 31 Jul 2019 13:25:15 GMT

I just did that and it works!

Thank you for your help.

Could you please explain me more what was the problem?

Re: Newly installed R80.20 gateways do not send logs to the R80.10 log server

_Val_ — Wed, 31 Jul 2019 13:36:06 GMT

If installing the database helped, there was no problem.

The log server was receiving and processing logs from the new GWs, but it was unable to interpret and show them, because it has had and old version of database where new GW objects did not exist. When deploying a new GW, always install database on a separate log server.

Re: Newly installed R80.20 gateways do not send logs to the R80.10 log server

prisciltetchou — Tue, 27 Aug 2019 07:31:59 GMT

Hello,

Sorry I am coming back with tis topic.

Now I can see logs from the GWs but some columns are blank like the rule name column.

I need to filter logs from rule's name but since it is blank, it makes it impossible for me.

Please how could I do to make it appear?

Thanks in advance for your help.

Re: Newly installed R80.20 gateways do not send logs to the R80.10 log server

PhoneBoy — Tue, 03 Sep 2019 16:03:43 GMT

If logs are coming across but you're not seeing all the data, this might be a bug and it'd be best to involve the TAC.