This post is a follow-up to https://community.checkpoint.com/t5/API-CLI-Discussion/API-show-logs/m-p/129384
The log paging method per the documentation is not working per my testing over the last year.
https://sc1.checkpoint.com/documents/latest/APIs/index.html?#web/show-logs
The SDK version was [re-]pulled fresh today.
The first batch of logs is received. The paging mechanism returns:
{
"logs": [],
"logs-count": 100,
"query-id": "<redacted>_b648614a-c0a7-4c46-b248-379b891052bf"
}
That is, "here are 100 more logs...." but the logs list returned is empty.
Specifics:
- MDS R81.10 JHF take 78
- MLM R81.10 JHF take 78
- Log indexing is enabled on MDS and MLM
In certain scenarios I am getting some of the log queries with some log data, but in every case I'm getting one or more empty responses.
Could someone please confirm API log paging is working, and what configuration? (which version and JHF, MDS or SMS)
I have a very old TAC case opened with no resolution. The next step is to rebuild the MLM which our engineer has been working on a process for, for months.
Here is a complete sample script if you would like to try:
#!/usr/bin/env python3
import os
import sys
import json
import getpass
# cpapi is a library that handles the communication with the Check Point management server.
from cpapi import APIClient, APIClientArgs
sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), '..')))
def main():
"""
take input from user before authenticating
"""
# getting details from the user
default_ip = '192.168.1.1'
default_username = 'administrator'
api_server = input("Enter server IP address or hostname: [{}] ".format(default_ip))
if not api_server:
api_server = default_ip
username = input("Enter username: [{}] ".format(default_username))
if not username:
username = default_username
if sys.stdin.isatty():
password = getpass.getpass("Enter password: ")
else:
print("Attention! Your password will be shown on the screen!")
password = input("Enter password: ")
client_args = APIClientArgs(server=api_server)
with APIClient(client_args) as client:
# create debug file. The debug file will hold all the communication
# between the python script and Check Point's management server.
client.debug_file = "api_calls.json"
# The API client, would look for the server's certificate SHA1
# fingerprint in a file. If the fingerprint is not found on the file,
# it will ask the user if he accepts the server's fingerprint.
# In case the user does not accept the fingerprint, exit the program.
if client.check_fingerprint() is False:
print("Could not get the server's fingerprint - Check connectivity with the server.")
sys.exit(1)
# login to server:
login_res = client.login(username, password)
if login_res.success is False:
print("Login failed:\n{}".format(login_res.error_message))
sys.exit(1)
query_data = {}
query_data['new-query'] = {}
query_data['new-query']['time-frame'] = 'today'
query_data['new-query']['filter'] = '(src:10.0.0.0/8 OR src:192.168.0.0/16) AND (dst:10.0.0.0/8 OR dst:192.168.0.0/16)'
query_data['new-query']['max-logs-per-request'] =100 # optional
run = True
query_id = False
print('Pulling logs...')
while run:
print(json.dumps(query_data, indent=2), flush=True) # debug
logs_res = client.api_call('show-logs',
payload=json.dumps(query_data))
if 'code' in logs_res.data:
print(logs_res.data['code'])
print(logs_res.data['message'])
sys.exit(1)
if not query_id:
query_id = logs_res.data['query-id']
query_data = {}
query_data['query-id'] = query_id
if not logs_res.data['logs']:
print('EMPTY LOG PULL', flush=True) # debug
print(json.dumps(logs_res.data, indent=2)) # debug
else:
print('LOGS RECEIVED', flush=True) # debug
if logs_res.data['logs'] or logs_res.data['logs-count'] > 0:
for log in logs_res.data['logs']:
if 'service' in log:
print(f"{log['src']},{log['dst']},{log['service']},{log['action']}") # debug
else:
print(json.dumps(logs_res.data, indent=2)) # debug
run = False
if __name__ == "__main__":
main()
