topic Re: how do i make sure a gateway sends logs to the server i want it to? in General Topics

how do i make sure a gateway sends logs to the server i want it to?

kb1 — Sat, 20 Jun 2020 00:07:21 GMT

so we have a few gateways (all 1100 appliances) that are sending logs to our primary server, how do i make sure they send logs to the secondary server? is there a way to make that change via cli? because this is how i have them set right now on the sartconsole object-

so since i have both servers ticked shouldnt it be sending logs to both? when i did make this change i also installed the policy and then did a tcpdump -i any port 257 and all i saw was the ip of the primary server, i did not see any logs being sent to the secondary server, so please do help.

Thank You.

Re: how do i make sure a gateway sends logs to the server i want it to?

Ilya_Yusupov — Sat, 20 Jun 2020 13:02:20 GMT

Try to perform install data base and then push policy.

According to your configuration the GW should send to both log servers.

Re: how do i make sure a gateway sends logs to the server i want it to?

Maarten_Sjouw — Sat, 20 Jun 2020 18:10:42 GMT

To my knowledge this is a limitation of the SMB gateways, it will only send logs to 1 server.

Re: how do i make sure a gateway sends logs to the server i want it to?

Tal_Paz-Fridman — Sun, 21 Jun 2020 12:19:14 GMT

Marteen is correct, this is a known limitation.

Please see sk105380 and sk159772

"Gaia Embedded appliances cannot send logs to more than one Security Management Server or Customer Log Server."

I will talk to the relevant R&D owner to see if this can be handled in SmartConsole to prevent adding more than one Log Server and notifying the administrator.

Thanks

Tal