topic Re: Multi-Domain Server Syslog to CP Log Exporter in Firewall and Security Management

Multi-Domain Server Syslog to CP Log Exporter

Ze_Kai_Ng — Tue, 16 Apr 2019 03:34:26 GMT

Hi,

I am currently having an issue where the MDS server syslog is not being exported to our syslog server using Check Point log exporter. Check Point log exporter seems to be working well with exporting received firewall syslog messages but MDS is unable to export the syslog messages.Forwarding to management server is enabled on MDS server webUI. Are there any configurations we are missing out?

Re: Multi-Domain Server Syslog to CP Log Exporter

Maarten_Sjouw — Wed, 17 Apr 2019 05:43:53 GMT

On a GAIA system, like and MDS, you have the option to send Syslog directly to the syslog server.
That being said, here is why you will not get the syslog information from the MDS into any Syslog Forwarder stream:
All syslog forwarders are connected to a specific domain, the MDS itself is not, if it will forward the syslog to a CP domain it will most probably be the Global domain. So when you have a forwarder on the global domain, I really don't know what you will get, all logs for all domains or only these syslogs?

Re: Multi-Domain Server Syslog to CP Log Exporter

Ze_Kai_Ng — Wed, 17 Apr 2019 09:25:01 GMT

Hi Marteen,

We are able to receive and export Check Point logs that are received in the Smart Console. We are however unable to receive and export syslog messages such as SSH login or WebUI login on the MDS sever.I suspect MDS server syslog is unable to send Check Point logs. I am attempting to use Log exporter to export logs in /var/log/messages but I have no clue about the log_file field parameter inside the targetConfiguration.xml.

Regards,Ze Kai

Re: Multi-Domain Server Syslog to CP Log Exporter

G_W_Albrecht — Wed, 17 Apr 2019 12:46:21 GMT

Afaik this is a known limitation - Logs are sent from CMA level only.

Re: Multi-Domain Server Syslog to CP Log Exporter

PhoneBoy — Thu, 18 Apr 2019 10:51:10 GMT

Log Exporter does not retrieve the Gaia OS logs.
If you want to export the OS logs, that has to be configured in the OS itself.
Screenshots or exact CLI commands you used would be helpful.