topic Re: cp_log_export - src/dst ip object name in General Topics

cp_log_export - src/dst ip object name

Luis_Miguel_Mig — Fri, 19 Jul 2024 08:26:51 GMT

I would like to include the fields src name and dst name when I export logs with cp_log_export in syslog format.
Does anybody know how?
The same way I see the src/dst object name in smartconsole logs I would like to see in the platform where I export checkpoint logs.

Re: cp_log_export - src/dst ip object name

PhoneBoy — Fri, 19 Jul 2024 19:30:18 GMT

Unfortunately, the object name for Source/Destination fields are not sent via Log Exporter, only the IP.
You can confirm this by reviewing the field names and descriptions here: https://support.checkpoint.com/results/sk/sk144192
I assume this would be an RFE.

Re: cp_log_export - src/dst ip object name

Luis_Miguel_Mig — Tue, 23 Jul 2024 10:44:37 GMT

I have the impression though that the intention is to send the object name too but it is a sort of a bug.

Some thing with origin name (gateway name)
At sk144192 you have the following fields:
origin, origin_ip, src, src_ip, dst, dst_ip and they are eventually all ip addresses and none of them names.

Re: cp_log_export - src/dst ip object name

PhoneBoy — Tue, 30 Jul 2024 20:25:31 GMT

I confirmed with R&D it is expected behavior not to export object names with Log Exporter.