topic Re: disable logging of identity awareness (ia agent / broker) session events in General Topics

disable logging of identity awareness (ia agent / broker) session events

Vincent_Bacher — Thu, 21 Mar 2024 11:13:42 GMT

Hi mates,

We are currently in the process of reducing the huge amount of logs that we have to process all the time.
One point here is the mass of identity awareness session events, such as log in, log out, session received from broker and so on.
Since we have almost 100k authenticated IA Agent / Terminal Server Agent sessions at peak times, this results in a mass of events, especially since each update generates three log entries (Access Layer PDP, Core Layer PDP and Domain Layer PDP).

Is there a way to deactivate these events? Maybe someone has had this challenge before.

Thanks
Vincent

Re: disable logging of identity awareness (ia agent / broker) session events

PhoneBoy — Thu, 21 Mar 2024 14:52:56 GMT

Just to be clear, we’re talking about security logs in Check Point and not in Windows, right?
A few examples (with sensitive details redacted) might not be a bad idea to understand the kinds of logs you’d like to see suppressed.

Re: disable logging of identity awareness (ia agent / broker) session events

Vincent_Bacher — Fri, 22 Mar 2024 07:41:07 GMT

@PhoneBoy wrote:
Just to be clear, we’re talking about security logs in Check Point and not in Windows, right?

Exactly.

Sure. See screenshot

Re: disable logging of identity awareness (ia agent / broker) session events

PhoneBoy — Fri, 22 Mar 2024 15:08:57 GMT

@Liel_Shaish is there a way to disable/tune down the logs here?