topic Re: Quantum Spark export logs to external server CEF format in Spark Firewall (SMB)

Quantum Spark export logs to external server CEF format

LUCAM — Mon, 21 Oct 2024 09:24:04 GMT

Hi,

I am new using Checkpoint firewalls,

I have a Quantum Spark 1500, I need to send logs to an external log server (Logstash) , I configured the connection using the UI, but the Logstash log indicates problems with the CEF syntax.
I tried to check the format using the commandcp_log_export but I have read that the command is not available on Spark.

How can I verify and modify the log format? In the UI the configuration in very basic and there are no option about this.

thank you

Re: Quantum Spark export logs to external server CEF format

_Val_ — Mon, 21 Oct 2024 10:36:37 GMT

cp_log_export only works on regular Gaia.

If your appliance is centrally managed, you can do that on your log server.

If you need to send logs to a syslog server from a locally managed appliance, use "add syslog-server" command, and also refer to the relevant part of the admin guide, for example, this.

Re: Quantum Spark export logs to external server CEF format

LUCAM — Mon, 21 Oct 2024 12:44:28 GMT

Thank you Val,

my appliance is locally managed,

I looked at the guide but there are the same options as in the UI, how do I check if the logs are sent correctly in CEF format or change this option?

thanks

Re: Quantum Spark export logs to external server CEF format

PhoneBoy — Mon, 21 Oct 2024 20:39:28 GMT

There is currently no option to change the log format being sent via Syslog on SMB appliances, which is NOT CEF.

Re: Quantum Spark export logs to external server CEF format

Dinesh_K — Fri, 02 May 2025 06:14:08 GMT

Hi,

In Quantum Spark 1800 Appliance version R81.10.08 (996001750), can we change the syslog format to CEF or not

Re: Quantum Spark export logs to external server CEF format

PhoneBoy — Mon, 05 May 2025 20:36:50 GMT

Still not possible.
If you require this functionality, please work with your local Check Point office on an RFE.