Problems with the API when obtaining audit logs

BAZUERO — Mon, 17 Jun 2024 20:12:46 GMT

I have a problem with the Check Point API that for some reason does not show me all the information that is in logic change, specifically when a rule is created in the Firewall in the SmartConsole application it shows me that I created the rule and I see that it was configured in the new rule as Source Address, Destination, VPN, ActionSettings.action.
This is what appears in SmartConsole

Logic Changes:

And This is what I get with the CheckPoint API to see the logs
{
"session_name": "micasita@17/6/2024",
"subject": "Object Manipulation",
"session_uid": "bd5711c1-fb22-4dec-84ee-1aee2d7076ac",
"sendtotrackerasadvancedauditlog": "0",
"type": "Audit",
"orig_log_server_attr": [
{
"isCHKPObject": "true",
"uuid": "58888ca8-4ac6-0f4a-9a6b-90aa1e32969c",
"resolved": "BI-DC"
}
],
"uid": "1c5a3310-a212-49d9-9393-93a44a634089",
"administrator": "micasita",
"client_ip": "192.168.1.1",
"id": "0a01641e-6f9c-670e-6670-484e00130001",
"objecttype": "Access Control Rule",
"fieldschanges": [
"Policy Names: 'Policies_BI'",
"Layer Name: 'Network'"
],
"logic_changes": [
"TrackSettings.useLogPerConnection: Changed from 'Disable' to 'Enable'",
"TrackSettings.track: Changed from '29e53e3d-23bf-48fe-b6b1-d59bd88036f9' to '598ead32-aa42-4615-90ed-f51a5928d41d'"
],
"severity": "Informational",
"product_family": "Network",
"product": "SmartConsole",
"sequencenum": "2",
"objectname": "CONFIGURATION",
"operation": "Create Rule"
}
As you can see in logic_changes in JSON format not all changes are shown, it only shows me two and the rest are not sent through the API for some reason.
Can anyone tell me why this happens and how I can get all the complete audit logs through the API?
Thank you and have a nice day.

Re: Problems with the API when obtaining audit logs

PhoneBoy — Thu, 20 Jun 2024 22:00:02 GMT

@Omer_Kleinstern?
I also suggest a TAC case: https://help.checkpoint.com

Re: Problems with the API when obtaining audit logs

Omer_Kleinstern — Sun, 23 Jun 2024 06:30:36 GMT

Paging @Nitzan_Massad

Re: Problems with the API when obtaining audit logs

Undel — Mon, 24 Jun 2024 08:15:43 GMT

+1, same problem

Re: Problems with the API when obtaining audit logs

Nitzan_Massad — Tue, 25 Jun 2024 08:19:36 GMT

this is a problem that we have encountered recently.

the management api show-logs will sometimes have problems with multivalued fields

@mahmods has led the solution to this problem
I will let him add the details on when the solution will arrive in the field

topic Re: Problems with the API when obtaining audit logs in API / CLI Discussion

Problems with the API when obtaining audit logs

Re: Problems with the API when obtaining audit logs

Re: Problems with the API when obtaining audit logs

Re: Problems with the API when obtaining audit logs

Re: Problems with the API when obtaining audit logs