topic Re: Send logs to SmartCenter and Syslog at the same time in General Topics

Send logs to SmartCenter and Syslog at the same time

Herve_SCHLECHT — Wed, 27 May 2020 14:39:44 GMT

Hello,

We have a CheckPoint architecture under R80.30 with Enforcement module and SmartCenter, since we installing a new SIEM, we need to send the logs to the SIEM through syslog. From the Enforcement Module can we send at the same time the logs to the SmartCenter and the syslog server ? Or we need to continue to pass through the SmarCenter that send on his side the logs to the syslog server.

BRgds

Re: Send logs to SmartCenter and Syslog at the same time

Wolfgang — Wed, 27 May 2020 14:57:14 GMT

@Herve_SCHLECHT

Yes, it's possible to send firewall logs directly to syslog. Follow instructions from

How to configure Security Gateway on Gaia OS to send FireWall logs to an external Syslog server

Wolfgang

Re: Send logs to SmartCenter and Syslog at the same time

_Val_ — Thu, 28 May 2020 13:16:11 GMT

Considering the topic-starter is on R80.30, I would rather refer to https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122323

Use Log Exported by the link

Re: Send logs to SmartCenter and Syslog at the same time

Wolfgang — Thu, 28 May 2020 13:56:41 GMT

Yes, log_exporter is the smarter solution. But if you want to have the logs send directly from the gateway not the CheckPoint logserver you can't use log_exporter. I think log_exporter can't be running on gateways.

Wolfgang

Re: Send logs to SmartCenter and Syslog at the same time

_Val_ — Thu, 28 May 2020 14:17:01 GMT

Log exported is the only supported solution With R80.30 and above. You probably win a second or two when forwarding directly from a gateway, but the recommended solution is to run exported on the management.