topic Re: LogExporter Filters in General Topics

LogExporter Filters

Agust — Tue, 12 Mar 2024 15:44:24 GMT

Hi guys!
We were testing filters for the LogExporter tool.
We managed to run some filtering but we have one filter pending, we are trying to filter the sending of firewall status logs, which come from the firewall messages.
We are editing the configuration file, one of the examples we were able to replicate is to send only audit logs but actually we need to disable only the sending of fw messages logs.
In the following way we edit the configuration file to meet the auditing requirement.
log_types>audit</log_types>
Can anyone give us some guidance?

Re: LogExporter Filters

PhoneBoy — Wed, 13 Mar 2024 00:21:27 GMT

That looks like the correct thing to edit (set it to audit instead of all).
If it's not working after restarting Log Exporter, I suggest a TAC case: https://help.checkpoint.com

Re: LogExporter Filters

Agust — Wed, 13 Mar 2024 14:00:11 GMT

Hello PhoneBoy.
How are you?
Thank you for your reply.
In case we want to filter only the logs of the firewall messages, do you know how we should edit this configuration file?

Re: LogExporter Filters

PhoneBoy — Wed, 13 Mar 2024 15:02:11 GMT

In your original post, you said "we need to disable only the sending of fw messages logs."
By sending only audit logs, you are filtering out ALL firewall message logs (as none will be sent).

In this response, you said "we want to filter only the logs of the firewall messages" which is a bit different.
What are your exact requirement(s) here?
Be as specific as possible and include version/JHF of your management.

Re: LogExporter Filters

Agust — Wed, 13 Mar 2024 15:35:43 GMT

Hello PhoneBoy.
Previously we had implemented the auditlog filter successfully.
Actually we need to see all the firewall logs, only excluding the fw messages, but we could not achieve it.
The management version is R81.20 and the JHF is take 10.
Thank you.

Re: LogExporter Filters

PhoneBoy — Wed, 13 Mar 2024 22:24:15 GMT

I don't understand what "fw messages" you are referring to.
Can you provide specific examples, preferably with a full log card (with sensitive details redacted)?

Re: LogExporter Filters

NiladriSarkar — Thu, 14 Mar 2024 11:30:17 GMT

As mentioned in sk122323, filtering works only for Action / Blade / Origin fields. Not sure if it is possible to filter out logs with respect to log messages.

Re: LogExporter Filters

Agust — Thu, 14 Mar 2024 16:43:23 GMT

Hi PhoneBoy.
The logs we refer to would be the following based on the following SK: sk144192

Re: LogExporter Filters

PhoneBoy — Thu, 14 Mar 2024 19:51:18 GMT

So you do NOT want logs that have something in this field?
Maybe something like the following in your <filters> stanza of $EXPORTERDIR/targets/<Name of Log Exporter Configuration>/conf/FilterConfiguration.xml:

    <field name="fw_messages" operator="and">
       <value operation="eq"></value>
    </field>

Otherwise, I suggest contacting the TAC: https://help.checkpoint.com