topic Re: Where to post??? in Training and Certification

Where to post???

trevorc — Sun, 08 Dec 2024 18:21:11 GMT

Hello,

This is my first post, so I may be completely in the wrong place!

I just completed some CCSA training, and I would like to ask some questions
based on that course. Which community should I be in to post questions
pertaining to that?

I"m new to Checkpoint, and I'm new to this community, so please be
gentle!!!

Thank you in advance,

Trevor

Re: Where to post???

the_rock — Sun, 08 Dec 2024 18:51:32 GMT

You got it Trevor, this is the right place brother 🙂

And welcome, we are always here to help, its a brotherhood/sisterhood community.

What questions did you have man?

Best,

Andy

Re: Where to post???

trevorc — Sun, 08 Dec 2024 19:11:37 GMT

Whew! What a relief to see your incredibly friendly greeting!!!
When I saw the name, "the_rock", I just knew that I was going
to get body slammed - your greeting was 180 degrees opposite
of that!!!

Andy, as I mentioned, I'm a newborn with Checkpoint, and so
i alert you of this to prepare you for my quesitons which may
appear to be very elementary. Based on where I am in my
Checkpoint learning journey, I truly am in "elementary" school.

Okay, my question has to do with a term that I saw in the
R81 Quantum Security Management Administration Guide.
Here is the term:

Audit Log
Log that contains administrator actions on a Management Server (login and logout, creation or modification of an object, installation of a policy, and so on).

Where is the "Audit Log" stored - that is, on which system does it reside?

Thanks Andy for taking on my question, and again for being so exceptionally kind
and pleasant with your reception!!!

Trevor

Re: Where to post???

the_rock — Sun, 08 Dec 2024 19:46:04 GMT

Btw, this is just me assuming logically what your question might be : - ). If its related to ccsa exam, below is best post about it. However, if not, please ask.

Andy

https://community.checkpoint.com/t5/Training-and-Certification/Resources-for-CCSA-exam/td-p/230205

Re: Where to post???

trevorc — Sun, 08 Dec 2024 20:33:42 GMT

Thanks for the quick response Andy.

No, my question is not related to the CCSA exam. I was going through the glossary in the guide, and when I came across that term - Audit Log - I wanted to add to my understanding. I'm not even thinking about the CCSA exam right now. My focus on learning this stuff is so that I can actually do some work in the practical world.

Thanks again Andy for the response, and for the link to the CCSA exam resource!

Trevor

Re: Where to post???

_Val_ — Mon, 09 Dec 2024 08:23:06 GMT

Hi Trevor, welcome to the fold. Training and Certification board is the correct place for your topic.

Re: Where to post???

_Val_ — Mon, 09 Dec 2024 09:38:47 GMT

The mentioned audit logs reside on the management server where one makes changes unless one configures log forwarding to another server.

Re: Where to post???

_Val_ — Mon, 09 Dec 2024 09:48:20 GMT

@trevorc in this case, you can "guess" where the question belongs. In case of the audit logs, it is most probably for CheckMates /Products/Quantum/ Management

However, don't be stressed about it. Admins will help you to move your post if you miss something and post it to the wrong category.

Re: Where to post???

the_rock — Mon, 09 Dec 2024 12:09:14 GMT

@trevorc hahahaha, your commend about body slamming, Im still laughing about it LOL

Anyway, dont worry, I never did such a thing in my life and I never would, but maybe I should change my username to the_pebble? : - )

Now, to your question. Those logs are indeed present on mgmt server itself and you can find them in smart console.

Andy

Re: Where to post???

the_rock — Mon, 09 Dec 2024 12:10:02 GMT

I will take some screenshots later and send them over, so you can see exactly where to find those logs.

Andy

Re: Where to post???

Don_Paterson — Mon, 09 Dec 2024 12:24:59 GMT

Don't forget CP4B (Check Point for Beginners) 😉. Save you a few screenshots:

https://community.checkpoint.com/t5/Check-Point-for-Beginners/Part-12-Logs-and-Reporting/ba-p/88234?cat=2

https://community.checkpoint.com/t5/custom/page/page-id/CommunityBeginnersChild?cat=2

Re: Where to post???

the_rock — Mon, 09 Dec 2024 12:49:40 GMT

I dont mind at all, not a slightest effort 🙂

Andy

Re: Where to post???

the_rock — Mon, 09 Dec 2024 12:59:12 GMT

@trevorc

I took few screenshots (doc file attached), but if not clear, we can do remote and I can show you in my lab. By the way, you can download smart console from the support site and just use demo option to log in if you dont have lab or real environment to check.

Andy

Re: Where to post???

Don_Paterson — Mon, 09 Dec 2024 13:06:14 GMT

Nice one!

Well worth considering Revision Control, or at least Revisions, along with the audit logs. Watch the video (as per the CCSA manual)

Main point is that Audit log is activity on the Security Management Server (SMS) and Revisions is about the database where all the policy and objects are stored. That Revisions is about the postgres database and capturing changes in there, as apposed to who logged into the SMS when, and made what changes.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Show-me-the-Videos.htm?tocpath=_____2

https://www.youtube.com/watch?v=_KJihPaTx2c

Re: Where to post???

the_rock — Mon, 09 Dec 2024 13:11:30 GMT

Im "throwing in" another great video by awesome @Magnus_Holmberg

Andy

Check Point Firewall - fwlog, audit log, messages

Re: Where to post???

trevorc — Mon, 09 Dec 2024 18:43:14 GMT

This is great!

Thanks Val!

Re: Where to post???

trevorc — Mon, 09 Dec 2024 18:46:53 GMT

Glad I could make you laugh Andy! Only good can come from a laugh - the more the better!!!

Here's a suggestion on your username change: "The_Pleasant_Guy"

Thanks for elevatng my knowledge about the whereabouts of the audit logs!!!

Re: Where to post???

trevorc — Mon, 09 Dec 2024 18:49:49 GMT

Thanks Val! It's very comforting to know that no one will want to hit me with a flame thrower because I didn't post a query in the correct place!!!

Re: Where to post???

trevorc — Mon, 09 Dec 2024 18:51:01 GMT

Andy, you've got a lot of customer service in your personality!!!

Many thanks!!!!

Re: Where to post???

trevorc — Mon, 09 Dec 2024 18:52:20 GMT

Looks like I've landed upon a gold mine in this community!!!

Thanks Don_Patterson!!!