topic Missing Logs - track long-lived TCP/IP connection in General Topics

Missing Logs - track long-lived TCP/IP connection

GeorgeF — Thu, 09 Nov 2023 06:24:05 GMT

Hi Experts,

Recently we use TCP connection to forward syslogs from client to server (both are Linux OS). It is interesting that we can see from client and server (by TCPdump command) that the TCP connection is established and syslog data packet were forwarded/received properly.

While on the SmartConsole -> logs , we only see some intermittent logs, which should continuous ?
I thought when the client are forwarding syslogs, the data packet should be continuous( long-lived TCP/IP connection ?) I checked on the client, the logs did generate continuously.

I find some info from https://support.checkpoint.com/results/sk/sk41248 , but it seems not mentioned how to track logs during long-lived TCP sessions.

Is it possible that the logs only track the TCP packet which has SYN ?

Thanks very much

Best regards

Re: Missing Logs - track long-lived TCP/IP connection

PhoneBoy — Thu, 09 Nov 2023 21:04:10 GMT

We generate a log upon first connection.
A session may consist of multiple connections (e.g. different elements on a webpage hosted in different places) which will update the existing log entry.
Likewise, if you have Accounting logging enabled or Detailed/Extended logging, the existing entry will update every 10 minutes.
These updates will be sent via Log Exporter as well.

Re: Missing Logs - track long-lived TCP/IP connection

GeorgeF — Fri, 10 Nov 2023 01:43:01 GMT

Hi,

Thanks very much for your reply.

As my understanding, it will generate a log when the TCP session is established. ( Yellow hightlighter)

And if the connection keeps open and keeps forwarding log packets then it won't generate more logs.

Until the server or client initiate "CLOSING THE CONNECTION" , or some Time-Out triggered closing the session.

Next time when a new SYN -> SYN+ACK -> ACK established a new connection with a new source port , it will generate a new log.

Is it right ? I think that would explain the intermittent logs perfectly.

Thanks again

Re: Missing Logs - track long-lived TCP/IP connection

PhoneBoy — Fri, 10 Nov 2023 04:25:52 GMT

You've got it right.