Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
gm446
Contributor

How to collect logs drom endpoint on the Endpoint server?

Hi all,

We are implementing Splunk SIEM in our organization, the log exporter works fine on the SMS and send all of our gateways logs, but i am trying to understand how to send client logs on the endpoint server. i enabled Log Upload feature for the Client Settings on SmartEndpoint.

I enable on the SmartConsole the "Logging & Status" and "Identity Logging" blades for the endpoint server, and enable the Log Indexing on the Logs tab but only few endpoint are sending logs to the server (about 5% of the endpoints). i also configure the log export in the exact same way i configure for the SMS but the endpoint server not exporting logs. i am trying to understand if i miss something here and how to troubleshoot this issue.

Thank you in advance,
Yossi.

 

0 Kudos
7 Replies
gm446
Contributor

i now succeed to send logs to splunk when i configure the log export via CLI,
but still Endpoint Server is not collecting any endpoint logs from users.

any ideas?

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Which client version is used and what upload settings are configured under client settings?

CCSM R77/R80/ELITE
0 Kudos
gm446
Contributor

Most of the clients are E87.30, some are 86.20, Server is R81.10.

those are the settings:

Screenshot 2023-08-09 163606.jpg

0 Kudos
gm446
Contributor

The strange thing is that some endpoints report logs perfectly, but only a few. This brings up the new that it is a setting in the agent, because the Client Settings are the same for the entire organization.

 

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Are all the clients internal or some external and is the endpoint server reachable for them via NAT?

CCSM R77/R80/ELITE
0 Kudos
gm446
Contributor

all the clients internal, there is no nat for the endpoint server.

 

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Suggest investigating further with TAC to get to the bottom of this. https://help.checkpoint.com

CCSM R77/R80/ELITE

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    Tue 23 Apr 2024 @ 08:00 AM (CDT)

    South US: HTTPS Inspection Best Practices

    Tue 23 Apr 2024 @ 11:00 AM (EDT)

    East US: What's New in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Tue 23 Apr 2024 @ 08:00 AM (CDT)

    South US: HTTPS Inspection Best Practices

    Tue 23 Apr 2024 @ 11:00 AM (EDT)

    East US: What's New in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82
    CheckMates Events