topic Re: R80 automation - VS logging settings through CLI/API in Firewall and Security Management

R80 automation - VS logging settings through CLI/API

Fredrik_Holmber — Mon, 20 Aug 2018 13:35:08 GMT

Hi,

As part of an R80 automation process creating VS-es using the API/CLI, we would like to set Logging parameters like log rotation at midnight + where to send logs (to mgmt or clm) etc.

Does anyone of you know where and how these parameters are set internally on R80? Unable to find any documentation covering these steps.

Would be very grateful for any pointers! 🙂

Example of a GUI setting we would like to automate through API/CLI:

Thanks!

Fredrik

Re: R80 automation - VS logging settings through CLI/API

_Val_ — Mon, 20 Aug 2018 13:53:19 GMT

As far as I know, you cannot use R80.X MGMT API to manage VSX at all. You need VSX Provisioning Tool

However, it is a simple scripting tool and does not have a setting you are looking for, due to my knowledge.

There is a slight chance I might be wrong, so I let Tomer Sole‌ to correct me, if anything.

Re: R80 automation - VS logging settings through CLI/API

Kaspars_Zibarts — Mon, 20 Aug 2018 13:53:30 GMT

From memory only simple gateways are supported. No cluster no vsx..

Re: R80 automation - VS logging settings through CLI/API

_Val_ — Mon, 20 Aug 2018 13:59:04 GMT

He seeks ANY CLI or API. Not only MGMT API, where indeed you cannot manipulate cluster and/or VSX objects

Re: R80 automation - VS logging settings through CLI/API

Fredrik_Holmber — Tue, 21 Aug 2018 08:36:31 GMT

Thanks for the input!

Valeri Loukine‌ and Kaspars Zibarts yes currently automating the VS creation using the VSX Provisioning Tool, since it's not supported through the API as you correctly stated (feature request!).

I simply want to modify the logging parameters either through the CLI or API. Automating through the GUI is not an option.. 😉

Is there a hidden Checkpoint CLI command to do this, or do I need to edit a config file or a postgres/sqlite DB field somewhere?

Here is the other logging parameter I need to modify:

Re: R80 automation - VS logging settings through CLI/API

_Val_ — Tue, 21 Aug 2018 10:39:45 GMT

Sorry, no CLI command for this yet, hidden or otherwise. And please please do not touch DB directly, especially for VSX

Re: R80 automation - VS logging settings through CLI/API

Fredrik_Holmber — Tue, 21 Aug 2018 13:42:02 GMT

Come on, there has to be a way, hack or not 🙂

Just like how API access is controlled through "/web/conf/extra/httpd2-webapi.conf". You enable access by modifying that file and restarting httpd using tellpm.

Where are the logging configuration settings for VS-es stored? In the Postgres DB?

To me it looks like any changes related to VSX, done in SmartConsole, are handled in "parallel" with the normal Session/Publish logic. The task is not listed in the "Recent Tasks" list either.

As soon as I do a change and press OK it executes the "VSX Operation Progress" window, followed by an "Operation Report" showing what could be script output:

What exactly is getting executed during that "VSX Operation"?

- Fredrik

Re: R80 automation - VS logging settings through CLI/API

PhoneBoy — Tue, 21 Aug 2018 14:15:27 GMT

You are correct that VSX objects are handled differently than non-VSX ones.

Unfortunately, we have never exposed an API (either legacy CPMI or a REST one) for handling VSX objects.

The VSX Provisioning Tool (a CLI command) is one way to automate things.

You can call this through the R80.x API using run-script, but it's not a perfect tool, and may be missing functionality.

I presume we will address these deficiencies in later releases.

Re: R80 automation - VS logging settings through CLI/API

_Val_ — Wed, 22 Aug 2018 08:41:12 GMT

There is a very a solid reason why VSX is not yet part of MGMT API and needs a provisioning tool. Unlike other gateway objects in MGMT DB, VSX is actually a mosaic of so-called vs slots. Each VS slot is a linked object with just one part of VS structure, with references to VS and VSX cluster member. For example, VS interlace and its settings, including IP address.

When VSX cluster is being deployed or manipulated, MGMT runs a background script which collects all vs slots, lists changes and pushes a provisioning script to physical GWs to be executed.

VSX object manipulations will come on the later stages of MGMT API development.

Re: R80 automation - VS logging settings through CLI/API

Fredrik_Holmber — Fri, 07 Sep 2018 12:47:16 GMT

Never take no for an answer! 😉

Your commands and mileage may vary, but this is in essence what you need to execute with dbedit using the run-script API call:

addelement network_objects VS_NAME log_servers:backup_log_servers network_objects:MGMT_SRV
addelement network_objects VS_NAME log_servers:send_logs_to network_objects:LOG_SRV
addelement network_objects VS_NAME log_servers:send_alerts_to network_objects:LOG_SRV
modify network_objects VS_NAME log_policy:log_switch_schedule times:Midnight
modify network_objects VS_NAME log_policy:scheduled_switch true

Log settings, fully automated 🙂

Have a nice weekend!

- Fredrik

Re: R80 automation - VS logging settings through CLI/API

PhoneBoy — Fri, 07 Sep 2018 17:01:28 GMT

Nicely done!