topic Re: CPLogtoSyslog 和Jumbo hotfix衝突 in Chinese 中文 https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/413#M111 <HTML><HEAD></HEAD><BODY><P>是的,我這篇PO出來之後就有Partner來問,我請他直接用新招了。</P></BODY></HTML> Wed, 11 Apr 2018 09:48:51 GMT Neville_Kuo 2018-04-11T09:48:51Z CPLogtoSyslog 和Jumbo hotfix衝突 https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/411#M109 <HTML><HEAD></HEAD><BODY><P>我遇到了:</P><P><BR />Package: R80.10 Jumbo Hotfix Accumulator (Take 91)<BR />conflicts with the following hotfixes:</P><P></P><P>Check_Point_CPLogToSyslog_R80.10_GA_jhf_T56_FULL.tgz</P><P></P><P>PS.請注意這隻和sk122323那個新的log exporter不同。</P></BODY></HTML> Wed, 11 Apr 2018 08:28:50 GMT https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/411#M109 Neville_Kuo 2018-04-11T08:28:50Z Re: CPLogtoSyslog 和Jumbo hotfix衝突 https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/412#M110 <HTML><HEAD></HEAD><BODY><P>這只有走在前面的人才能遇到,謝謝分享</P><P></P><P>不過在一開始 sk122323 (Log Exporter) 有說這句話：</P><P></P><DIV><DIV class=""><DIV><TABLE border="0" cellpadding="2" cellspacing="0" style="border-color: #e6edf7;" width="100%"><TBODY><TR><TD valign="top"><TABLE border="0" cellpadding="0" cellspacing="0" style="border-color: #c6daf0;" width="100%"><TBODY><TR><TD valign="top" width="100%"><TABLE border="0" cellpadding="0" cellspacing="2" style="border-color: #c6daf0;" width="100%"><TBODY><TR><TD width="100%"><DIV class=""><DIV class=""><H2>Transition from CPLogToSyslog to Log exporter</H2><P><STRONG>Recommended method to move from the existing CPLogToSyslog to the new log exporter.</STRONG></P></DIV></DIV></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE></DIV></DIV></DIV><P>&nbsp;</P><P>所以我在開始用Log Exporter前，都將客戶原本的LEA and CPLogToSyslog的作法移除乾淨，再來使用新的Log Exporter</P><P>避免不同作法相互干擾或增加無謂的Loading.</P></BODY></HTML> Wed, 11 Apr 2018 09:46:42 GMT https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/412#M110 RickLin 2018-04-11T09:46:42Z Re: CPLogtoSyslog 和Jumbo hotfix衝突 https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/413#M111 <HTML><HEAD></HEAD><BODY><P>是的,我這篇PO出來之後就有Partner來問,我請他直接用新招了。</P></BODY></HTML> Wed, 11 Apr 2018 09:48:51 GMT https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/413#M111 Neville_Kuo 2018-04-11T09:48:51Z Re: CPLogtoSyslog 和Jumbo hotfix衝突 https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/414#M112 <HTML><HEAD></HEAD><BODY><P>感謝Neville的提點，這比用<SPAN style="color: #333333; background-color: #ffffff;">CPLogToSyslog容易多了。</SPAN></P><P>另外，請教大伙，如果只要送SmartEvent，而且Severity=Critical / High到syslog server有什麼方式可以做呢？？？</P></BODY></HTML> Thu, 12 Apr 2018 01:17:23 GMT https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/414#M112 Webb_Huang 2018-04-12T01:17:23Z Re: CPLogtoSyslog 和Jumbo hotfix衝突 https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/415#M113 <HTML><HEAD></HEAD><BODY><P>我第一個想到的笨方法:</P><P>做兩個threat prevention policy,綁定兩個不同等級的profile,然後只對high以上的那個profile policy做log,另一條不做log,理論上應該就只會看到你想看的東西了。</P></BODY></HTML> Thu, 12 Apr 2018 02:58:52 GMT https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/415#M113 Neville_Kuo 2018-04-12T02:58:52Z Re: CPLogtoSyslog 和Jumbo hotfix衝突 https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/416#M114 <HTML><HEAD></HEAD><BODY><P>謝謝Neville的經驗分享，目前匯出log的兩種方式建議請多採用sk122323 Log Exporter</P><P>只要R80.10 T56以上Jumbo fix版(包括最新的T91)都可以支援</P></BODY></HTML> Thu, 12 Apr 2018 04:05:14 GMT https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/416#M114 Danny_Yang 2018-04-12T04:05:14Z Re: CPLogtoSyslog 和Jumbo hotfix衝突 https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/417#M115 <HTML><HEAD></HEAD><BODY><P>目前CPlogtosyslog的確只支援至T56</P><P><IMG class="image-1 jive-image" src="https://community.checkpoint.com/legacyfs/online/checkpoint/64554_pastedImage_2.png" style="width: 620px; height: 99px;" /></P></BODY></HTML> Thu, 12 Apr 2018 04:11:29 GMT https://community.checkpoint.com/t5/Chinese-%E4%B8%AD%E6%96%87/CPLogtoSyslog-%E5%92%8CJumbo-hotfix%E8%A1%9D%E7%AA%81/m-p/417#M115 Danny_Yang 2018-04-12T04:11:29Z