topic Re: Massive logging for user in SASE and Remote Access

Massive logging for user

Tony_Graham — Wed, 17 Mar 2021 19:32:47 GMT

Tomer,

I am seeing massive number of logs being generated for one of my users. It shows as Login>Logout>Logout>Login>Login>Update>Lather Rinse Repeat. This is happening EVERY SECOND!!

It has to be generating a lot of activity for your cloud service.

Re: Massive logging for user

the_rock — Wed, 17 Mar 2021 21:53:46 GMT

Can you attach the screenshot? I always work with 2 customers who use mgmt cloud server and I never seen this problem.

Andy

Re: Massive logging for user

Tony_Graham — Wed, 17 Mar 2021 22:09:01 GMT

See attached. Even more odd it his active status is Disconnected most of the time.

Username redacted.

Re: Massive logging for user

the_rock — Wed, 17 Mar 2021 22:13:56 GMT

Wait a second...is this regarding specifically identity awareness?? The reason I ask is because I dont see it from smart-1 cloud instance, but harmony connect...I dont have that instance running for any customer, so cant say for sure.

Re: Massive logging for user

Tony_Graham — Wed, 17 Mar 2021 22:21:36 GMT

What I am seeing is in the logs and events viewer of the beta. Just absolutely flooded with these entries.

I haven't done anything special. I do note that at this time it has stopped so I assume the user powered

down for the day. **Confirmed user shutdown laptop. Logging is looking more normal now. I assume when

he powers on tomorrow the flood will begin again.

Re: Massive logging for user

PhoneBoy — Wed, 17 Mar 2021 22:22:49 GMT

Paging @Tomer_Sole

Re: Massive logging for user

the_rock — Wed, 17 Mar 2021 22:23:07 GMT

what Identity source is this user using? Identity agent, regular AD query??

Re: Massive logging for user

Tony_Graham — Wed, 17 Mar 2021 22:26:13 GMT

There is no AD involved. All I have done is create my beta account and send 3 users invites to install agents on 3 machines.

So I have exactly 3 accounts enrolled in the beta.

1 user laptop seems to be having an issue where it just floods the system with these login/logout/update requests all day.

Re: Massive logging for user

PhoneBoy — Wed, 17 Mar 2021 22:28:37 GMT

Just to let @the_rock know, the Identity Awareness integration in Harmony Connect is different from what's supported on a traditional gateway.
It supports SAML providers (Azure AD, Okta, etc) directly and doesn't use the methods supported on a regular Check Point gateway.
Have you configured an Identity Provider at all?

Re: Massive logging for user

Tony_Graham — Wed, 17 Mar 2021 22:32:31 GMT

Not that I am aware of. I just checked and I never activated it.

No idea why it started flooding me with Identity awareness logs.

Like I said when the guy shut his laptop down it stopped.

Re: Massive logging for user

PhoneBoy — Wed, 17 Mar 2021 22:34:52 GMT

Have the user Collect Logs off the laptop (it's a button in the Harmony Connect app) and send them to @Tomer_Sole.
He'll probably contact you out-of-band tomorrow morning.

Re: Massive logging for user

Tony_Graham — Wed, 17 Mar 2021 22:36:12 GMT

Will do.

Re: Massive logging for user

the_rock — Wed, 17 Mar 2021 22:45:27 GMT

Sorry brother, I figured it was something else, but was not sure...too many products :))

Re: Massive logging for user

PhoneBoy — Wed, 17 Mar 2021 22:46:39 GMT

Trust me, I know 🙂

Re: Massive logging for user

Tony_Graham — Wed, 17 Mar 2021 22:54:36 GMT

No apologies required! Have a pint my friend. It's St. Patty's Day!

Re: Massive logging for user

Tomer_Sole — Wed, 17 Mar 2021 23:53:01 GMT

Indeed, if this is for a single end user, this should not happen, these many logs at the portal do not give a big value to the admin that sees them. And it could indicate on a potential problem with Harmony Connect App that runs on that single endpoint.

If this is for many end users connecting to the Internet at the same time then it's probably less of an issue, and you can use filters or start from the Access Control or Cyber-Attack View overview pages to drill down to the needed events.

Either way let's work this out as a support ticket. Check Point Support handles trials for cloud products as well. Harmony Connect for Users is in public beta but already supported by TAC. See exact steps for submitting support tickets for Harmony Connect at https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk154712

Re: Massive logging for user

Tony_Graham — Thu, 18 Mar 2021 15:40:08 GMT

I will first work on replicating the issue and see if I can pinpoint the cause.

As there are frequent updates to the Harmony Connect app it could be something

that has already been resolved in an update. I will start by asking the end user to update

Harmony Connect to the latest version.

Re: Massive logging for user

PhoneBoy — Thu, 18 Mar 2021 15:45:08 GMT

The client generally should auto-update.
If that's not happening, that's a different problem 🙂

Re: Massive logging for user

Tony_Graham — Thu, 18 Mar 2021 15:49:01 GMT

Well, I have not seen it auto update on my system. I tend to open the app once in awhile to see if anything has changed and it has stated 'version update available'

or something along those lines a couple of times now. I clicked on it to update Connect. Maybe I am just catching it before it auto installs, I don't know.

Re: Massive logging for user

Tomer_Sole — Thu, 18 Mar 2021 18:30:50 GMT

In general we are monitoring end users that are active and contain an old version and contact the administrator of their account. The automatic updates happen behind the scenes. So if you weren't contacted, you should be fine