topic Re: Automatic deletion of logs. in General Topics

Automatic deletion of logs.

Matlu — Wed, 10 Jan 2024 14:19:11 GMT

Hello,

What is the best way to "determine" if my SMS is deleting my oldest logs?

What we want to know is, if we can have a control over the logs, to avoid that the path where the logs are stored, fill up and saturate the SMS disk.

How many days by default does an SMS store logs when it has a Cluster attached to it?

Greetings.

Re: Automatic deletion of logs.

Chris_Atkinson — Wed, 10 Jan 2024 14:43:17 GMT

Options exist within SmartConsole to control retention behavior, typically this is based on remaining space metrics either capacity threshold or percentage based.

Other metrics aren't so uniform and might vary significantly from one environment to the next based on logging rates / volume of managed gateways etc

Re: Automatic deletion of logs.

G_W_Albrecht — Wed, 10 Jan 2024 15:31:39 GMT

See https://community.checkpoint.com/t5/General-Topics/Define-log-retention/m-p/54642#M10915 for the settings. Manual check can be perfomed by looking into $FWDIR/log/ directory on Security Management Server.

Re: Automatic deletion of logs.

Matlu — Wed, 10 Jan 2024 14:51:24 GMT

Hello,

I would like to find the oldest logs that are stored in my SMS, and be able to "export" them to an external device.

I understand that the oldest logs, I could see them in the route of
"cd /var/log/opt/CPsuite-R80/fw1/log", right?

We want to find a way, for example, that the SMS only stores the last 30 days of logs, and that after that time, it can "overwrite" them automatically, so that we have control over the storage.

Re: Automatic deletion of logs.

the_rock — Wed, 10 Jan 2024 14:56:36 GMT

Hey bro,

Links @G_W_Albrecht gave are amazing reference.

Best,

Andy