topic Log retain policy for CP in General Topics

Log retain policy for CP

Ihenock1011 — Tue, 16 Jul 2024 11:49:27 GMT

Hi All,

I have checkpoint security gateway r81.10 and also dedicated log server I want to know the default log retention policy for checkpoint logs. Until when will the log remain on the server, and where exactly can we find the older log files?

Thanks,

Re: Log retain policy for CP

Chris_Atkinson — Tue, 16 Jul 2024 14:11:58 GMT

It's typically a little more involved if you are asking for a "time" metric

What is the log rate and how much storage / space does the log server have?

Re: Log retain policy for CP

the_rock — Tue, 16 Jul 2024 14:10:22 GMT

I am pretty sure if no settings are changed on the log server itself, it would only start deleting old log files once disk space is full. By default, it rotates to new log file every night at midnight, or when log file reaches 2 GB in size, whichever comes first.

Those are stored in $FWDIR/log directory on the mgmt server.

I will send you some screenshots shortly from R81.20 lab. Version does not matter, its been the same way for probably 20+ years now.

Andy

Re: Log retain policy for CP

the_rock — Tue, 16 Jul 2024 14:17:02 GMT

Hopefully screenshots attached in word doc help.

Andy

Re: Log retain policy for CP

PhoneBoy — Tue, 16 Jul 2024 18:34:36 GMT

You configure the Retention Policy on the relevant management/log server object.
These are the defaults from the R82 EA, but it's similar in other versions:

Logs outside of this configured criteria are deleted.
The files in $FWDIR/log need to be copied off to a separate system if you wish to keep them for longer.
Note that are multiple log files (e.g. log-file-name.log*) and all the files are needed.