topic Re: Software Blades and Logs questions in General Topics

Software Blades and Logs questions

Di_Junior — Sun, 02 Sep 2018 17:12:20 GMT

Dear Mates I have few questions that I nedd help me:

1. Is there any way to find out the all the software blades that have ever been activated and used in a Check Point solution? even if it is no longer in use

2. Is it possible for the "admin" user to delete logs on smartView Tracker in Management tab?

3. Is there any way to recover the "messages" files in /var/log/messages if it has been deleted? By recovering I mean with the old logs in there

4. Is it possible to view all the commands run in "Expert" mode after exiting the mode and re-entering again?

Your help will be appreciated.

Thanks in advance.

Re: Software Blades and Logs questions

PhoneBoy — Sun, 02 Sep 2018 18:38:41 GMT

1. Audit Logs in SmartConsole. For example, in this case, I activated Mobile Access Blade.

2. Yes. In addition, log files can also be deleted in Expert Mode.

3. If /var/log/messages is deleted (which it does get rotated periodically), there is no recovery. You should be backing this up or configure Gaia OS to send syslog messages to an external syslog server.

4. By default, we do not log commands executed in expert mode. There are ways built into bash that will allow you to send commands executed to syslog, for example: logging - How to log all Bash commands by all users on a server? - Ask Ubuntu

Re: Software Blades and Logs questions

Di_Junior — Sun, 02 Sep 2018 20:16:58 GMT

Thank you very much Dameon Welch Abernathy‌

Re: Software Blades and Logs questions

Marco_Valenti — Mon, 03 Sep 2018 07:14:21 GMT

you can have an overview of the enable blades from the gateway with the command enabled_blades or cpview

Re: Software Blades and Logs questions

Di_Junior — Tue, 04 Sep 2018 22:41:29 GMT

Hi Dameon Welch Abernathy‌ we are experiecing something strange on our environment, the file /var/log/messages contents is changing and we cannot see the previous logs. Is this normal? is there any configure that can be done to cause this.

Re: Software Blades and Logs questions

PhoneBoy — Tue, 04 Sep 2018 22:52:51 GMT

The script /etc/cron.daily/logrotate is called daily, generally at midnight.

It calls the logrotate binary, which is configured with /etc/logrotate.conf.

In the default configuration:

Logs are rotated weekly
We keep four weeks of backlogs

This, of course, can be changed.

Re: Software Blades and Logs questions

Di_Junior — Tue, 04 Sep 2018 22:57:31 GMT

Is it possible to see the logs of the of four weeks ago? in which file can it be retrieved

Re: Software Blades and Logs questions

Di_Junior — Tue, 04 Sep 2018 23:14:27 GMT

This is our configuration, and it looks like it rotates every four 4 weeks, but we want to find where the backlogs is stored after that. There are some strange changes that was done on our systems recently, and we cant find it. Your help will be appreciated.

Re: Software Blades and Logs questions

PhoneBoy — Tue, 04 Sep 2018 23:24:28 GMT

They are deleted after the fourth week, not stored anywhere.

Re: Software Blades and Logs questions

PhoneBoy — Tue, 04 Sep 2018 23:26:31 GMT

If you suspect foul play, it might be worth giving our Incident Response team a call.

Incident Response | Check Point Software

Re: Software Blades and Logs questions

Di_Junior — Wed, 05 Sep 2018 00:00:02 GMT

Thanks for your help.