topic Re: Third Party Syslogs to Check Point Logging Server Primary/Secodary in General Topics

Third Party Syslogs to Check Point Logging Server Primary/Secodary

Heath — Mon, 11 Nov 2024 23:05:59 GMT

We have to Management/Logging servers setup. I know when we setup a gateway we setup the primary and secondary servers. So when one doesn't respond other will start getting the logs.

We have our Cisco ASA's successfully syslogging to the primary CP Management Server and assume we need to syslog to both to support redundancy. Is there an admin guide explaining how the logs are processed between the two CP Management/Logging servers?

Re: Third Party Syslogs to Check Point Logging Server Primary/Secodary

PhoneBoy — Thu, 14 Nov 2024 01:15:50 GMT

To the best of my knowledge, the only way you get logs to both the primary and secondary HA server is to log to both management servers.
That applies both to regular gateway logs and syslog.

Re: Third Party Syslogs to Check Point Logging Server Primary/Secodary

the_rock — Thu, 14 Nov 2024 01:54:06 GMT

Im not aware of any official guide for it, but what Phoneboy said makes total sense. Maybe closest document I can think of is below.

Andy

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitoring_AdminGuide/CP_R81_LoggingAndMonitoring_AdminGuide.pdf

Re: Third Party Syslogs to Check Point Logging Server Primary/Secodary

PhoneBoy — Thu, 14 Nov 2024 13:45:25 GMT

It was the conclusion I came to after reviewing CheckMates and a couple of TAC cases. 😉

Re: Third Party Syslogs to Check Point Logging Server Primary/Secodary

the_rock — Thu, 14 Nov 2024 14:54:19 GMT

Ok, makes sense : - )