topic Maestro Audit Logs - Where are they? in Hyperscale Firewall (Maestro)

Maestro Audit Logs - Where are they?

Timothy_Hall — Sun, 14 Aug 2022 03:43:37 GMT

This may seem like a silly question, but anytime you do something major on a Maestro Orchestrator/SGM that could impact production you are asked to enter your name and a reason before giving a final confirmation. I'm on Maestro R81.10 and can't figure out where these audit logs are stored on the Orchestrators or SGMs. The documentation claims that the /var/log/command_logger.log file has them but it is always empty; show smo audit-log comes up with nothing as a result. When I try to run the asg log audit command if throws a usage error asking for a filename to read; guess it can't find them either. They are not in /var/log/messages* and they aren't supposed to be anyway according to sk172923: The /var/log/messages file does not save Maestro Gaia Clish commands. I've run exhaustive file searches in the /var partition trying to find my entered name in a far-flung log file somewhere. Nope. Not in the SmartConsole traffic or audit logs either.

OK I give up, where are these Maestro audit logs written and more importantly how can I access them?

Re: Maestro Audit Logs - Where are they?

Chris_Atkinson — Tue, 16 Aug 2022 02:25:32 GMT

Example Syntax

[Expert@HostName-ch0x-0x:0]# asg log --file audit

audit

If you specify the log type, the output shows all audit logs in the /var/log/ directory.

To specify a log file, enter its full path and name.

For example: /var/log/asgaudit.log.1

Source: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Maestro_AdminGuide/Topics-Maestro-AG/Viewing-Log-File-asg_log.htm

Re: Maestro Audit Logs - Where are they?

Timothy_Hall — Tue, 16 Aug 2022 14:12:11 GMT

Thanks, the /var/log/asgaudit.log* file has what I am looking for on the Orchestrator.

However the asg log command seems to be broken, at least on the Orchestrator R81.10 with no Jumbo HFA:

Still can't find any audit logs on the SGM, /var/log/asgaudit.log* does not exist and the following output is not correct as many changes requiring audit have recently been made:

[Expert@SG1-ch01-01:0]# asg log --file audit
No info to display.
[Expert@SG1-ch01-01:0]#

Re: Maestro Audit Logs - Where are they?

the_rock — Tue, 16 Aug 2022 15:02:40 GMT

I pretty much found same thing as @Chris_Atkinson

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Maestro_AdminGuide/Topics-Maestro-AG/Command-Auditing-asg_log_audit.htm?Highlight=audit

Maybe Maestro expert Lari Luoma may know.

Andy

Re: Maestro Audit Logs - Where are they?

Tom_Kendrick — Tue, 16 Aug 2022 16:44:52 GMT

Just to add, I've asked internally for more info, and hopefully I will get something soon. As soon as I get the info, I'll share.

Re: Maestro Audit Logs - Where are they?

Chris_Atkinson — Wed, 17 Aug 2022 02:23:55 GMT

If you touch or create the file do you see it start to be populated?

Otherwise TAC or try updating the Jumbo would be my remaining thoughts.

Re: Maestro Audit Logs - Where are they?

_Val_ — Mon, 22 Aug 2022 10:18:55 GMT

@Anatoly can you please answer?

Re: Maestro Audit Logs - Where are they?

Lari_Luoma — Fri, 02 Sep 2022 04:46:27 GMT

If things don't work like documented in the Admin Guide, it's worth opening an SR with TAC to get the solution. I don't see any final answers for this so I will chase this internally a bit and comment here.