Dedicated Log Server

[az26]

Hi, I have a small setup with 2 Security GW, one MGMT Server and one Dedicated Log Server.
For the MGMT server I selected:

• Endpoint Policy Mamangement
• Logging & Status + Identity Logging
• SmartEvent Server
• SmartEvent Correlation Unit

Then under the Logs tap => Additional Logging Configuration, I configured it to forward the log files to the Dedicated Log Server once ever Midnight.

And the Dedicated Log Server, I selected:

• Logging & Status 
• SmartEvent Server
• SmartEvent Correlation Unit

Is this the correct configuration? 

What happens when the MGMT server disk becomes full? I have selected when it reach 5% disk space to stop logging, in this case would the logs be sent directly to the Dedicated Log Server or just get ignored?

Lastly, for the licensing, I think with this setup we need 2 licenses for Logging, isn't it?

I remember when I deselected Logging & Status, and SmartEvent, options from MGMT server, the logs became weird and I had to specify a folder by date (I mean when i wanted to search for a log from Logs & Events).

[Lesley]

Why not send all logs towards de log server directly and configure the MGMT as backup log server? What you configured is of course also possible. 

I purchased this license for the dedicated log server. CPSB-LOGS Security Management - Logging and Status Blade, Includes SmartLog and SmartView Tracker applications

[Tomer_Noy]

Fully agree. It would make more sense to send the logs to the log server, and have the Management as backup, without any log forwarding. This is configured in the Gateway editor in the Logs sub-page

I also saw that you activated Endpoint Policy Management. If you are not using Check Point's Endpoint solution on your PCs / laptops, then you don't need it and it's better to deactivate it. It adds a lot of components that will run on the Management that you don't need.

Last, in such small environments, you usually don't need multiple SmartEvent servers activated. Usually, it would be enough to activate it only on the Log Server (unless HA for reporting is important for you in case the log server goes down).