topic Re: How to collect logs drom endpoint on the Endpoint server? in Endpoint

How to collect logs drom endpoint on the Endpoint server?

gm446 — Wed, 09 Aug 2023 13:46:17 GMT

Hi all,

We are implementing Splunk SIEM in our organization, the log exporter works fine on the SMS and send all of our gateways logs, but i am trying to understand how to send client logs on the endpoint server. i enabled Log Upload feature for the Client Settings on SmartEndpoint.

I enable on the SmartConsole the "Logging & Status" and "Identity Logging" blades for the endpoint server, and enable the Log Indexing on the Logs tab but only few endpoint are sending logs to the server (about 5% of the endpoints). i also configure the log export in the exact same way i configure for the SMS but the endpoint server not exporting logs. i am trying to understand if i miss something here and how to troubleshoot this issue.

Thank you in advance,
Yossi.

Re: How to collect logs drom endpoint on the Endpoint server?

gm446 — Thu, 10 Aug 2023 11:29:27 GMT

i now succeed to send logs to splunk when i configure the log export via CLI,
but still Endpoint Server is not collecting any endpoint logs from users.

any ideas?

Re: How to collect logs drom endpoint on the Endpoint server?

Chris_Atkinson — Thu, 10 Aug 2023 14:28:46 GMT

Which client version is used and what upload settings are configured under client settings?

Re: How to collect logs drom endpoint on the Endpoint server?

gm446 — Fri, 11 Aug 2023 05:17:08 GMT

Most of the clients are E87.30, some are 86.20, Server is R81.10.

those are the settings:

Re: How to collect logs drom endpoint on the Endpoint server?

gm446 — Sun, 13 Aug 2023 10:48:09 GMT

The strange thing is that some endpoints report logs perfectly, but only a few. This brings up the new that it is a setting in the agent, because the Client Settings are the same for the entire organization.

Re: How to collect logs drom endpoint on the Endpoint server?

Chris_Atkinson — Sun, 13 Aug 2023 13:01:06 GMT

Are all the clients internal or some external and is the endpoint server reachable for them via NAT?

Re: How to collect logs drom endpoint on the Endpoint server?

gm446 — Sun, 13 Aug 2023 13:45:15 GMT

all the clients internal, there is no nat for the endpoint server.

Re: How to collect logs drom endpoint on the Endpoint server?

Chris_Atkinson — Sun, 13 Aug 2023 22:14:59 GMT

Suggest investigating further with TAC to get to the bottom of this. https://help.checkpoint.com