How to collect logs drom endpoint on the Endpoint server?

[gm446]

Hi all,

We are implementing Splunk SIEM in our organization, the log exporter works fine on the SMS and send all of our gateways logs, but i am trying to understand how to send client logs on the endpoint server. i enabled Log Upload feature for the Client Settings on SmartEndpoint.

I enable on the SmartConsole the "Logging & Status" and "Identity Logging" blades for the endpoint server, and enable the Log Indexing on the Logs tab but only few endpoint are sending logs to the server (about 5% of the endpoints). i also configure the log export in the exact same way i configure for the SMS but the endpoint server not exporting logs. i am trying to understand if i miss something here and how to troubleshoot this issue.

Thank you in advance,
Yossi.

[gm446]

i now succeed to send logs to splunk when i configure the log export via CLI,
but still Endpoint Server is not collecting any endpoint logs from users.

any ideas?

[Chris_Atkinson]

Which client version is used and what upload settings are configured under client settings?

[gm446]

Most of the clients are E87.30, some are 86.20, Server is R81.10.

those are the settings:

[gm446]

The strange thing is that some endpoints report logs perfectly, but only a few. This brings up the new that it is a setting in the agent, because the Client Settings are the same for the entire organization.

[Chris_Atkinson]

Are all the clients internal or some external and is the endpoint server reachable for them via NAT?

[gm446]

all the clients internal, there is no nat for the endpoint server.

[Chris_Atkinson]

Suggest investigating further with TAC to get to the bottom of this. https://help.checkpoint.com