topic Re: External syslog solution in Off Topic

External syslog solution

jfischer — Tue, 16 Apr 2024 13:43:02 GMT

I am looking for a recommendation on an external syslog solution which can capture the log entries for forensic purposes.

Re: External syslog solution

PhoneBoy — Tue, 16 Apr 2024 16:11:37 GMT

This is more of an "Off Topic" question 🙂

Your favorite Linux distribution includes a syslog server, either as part of the install or is installable (e.g. syslog-ng)
In the very distant past, I've used Kiwi Syslog on Windows, which appears to now be owned by Solarwinds.
For other options, I defer to the rest of the community.

Re: External syslog solution

the_rock — Tue, 16 Apr 2024 16:14:07 GMT

Splunk is good for that.

Re: External syslog solution

jfischer — Tue, 16 Apr 2024 16:24:39 GMT

I should clarify, I am trying to get to Smart-1 Cloud but the logging retention is only 90 days based upon the calculations. I need a solution to store log files 4-7 years (based upon who you ask). The hosted solutions were outside the scope of what could be justified. The logs need to roll into some sort of cold storage solution but Checkpoint has not got around to that solution.

Re: External syslog solution

the_rock — Tue, 16 Apr 2024 16:47:39 GMT

We use siem elastic, its awesome. Not sure what is longest log retention, but will ask one of colleagues in that team.

Re: External syslog solution

PhoneBoy — Tue, 16 Apr 2024 20:56:23 GMT

Some of the SKUs in the Product Catalog actually state a 90-day retention time for logs.
You can purchase longer retention using the SKU: CPSM-EVENTS-EXT-RET12M-1Y (this extends it to 1 year).

If you're going to export from Smart-1 Cloud (would have been a good thing to mention up-front), you will need to have one or more of the following SKUs: CPSM-CLOUD-1GB-LOGEXP-1Y
You should also consider using something known to work with Log Exporter (what we use on the backend): https://support.checkpoint.com/results/sk/sk122323

Strongly suggest working with your local Check Point office on this to ensure you get the solution that will best meet your needs.