Export a huge amount of logs to CSV file

[Debon27]

Hi, I would like to know if possible to export to a CSV file a huge amount of logs after applying a filter criteria. I know that I can expoert to excel from smartview, but I need to download at least 10 days of logs. Is there a way to achieve this different to having to download all .log files? Thanks.

[G_W_Albrecht · Accepted solution]

The sk118002 gives the solution:

• In R80, by default, the export to .csv only exports the number of records in the current view (50 records) unless scrolling down.
• In R80.x this number is limited up to 217 records.
• In R81 for SmartView web application, you can export up to 1M logs.
• Starting from R81, export to Excel from SmartConsole is disabled.

Solution:

To export all the required logs, use one of the below options:

• Use SmartView on the web portal https://SMS_IP/smartview
  (Limitation is 1 million logs that can be exported)
  
  
• Use the legacy R80 SmartView Tracker application (CPlgv.exe) under C:\Program Files (x86)\CheckPoint\SmartConsole\R80\PROGRAM
  

Follow sk117773 to download the exported PDF or CSV file.

[rrbranco]

Note that using SmartView Tracker may require to open and export several log files if they are / were log switched .

[Fiqri_kurniawan]

Hi Sir,

Let me ask you a question, and I hope you'll be willing to answer.

I have a request to export logs at a checkpoint. I'm already using SmartView and have set it to 1Million logs. We need about 3 months of logs going back, but when I try to export the maximum 1Million logs, the results only show 4 days. 😁

So, can we increase the 1M logs?

Thanks, sir. 🙏

[rrbranco]

Hello,

I'm not sure of how long in the past you can go with the available log files in your environment.  

However, you can take a look at fwm logexport and see if it can help.

• "fwm logexport" command - https://support.checkpoint.com/results/sk/sk118519
• 'fwm logexport' command creates the output file in ASCII format - https://support.checkpoint.com/results/sk/sk37660
• R82.10 Quantum Security Management Administration Guide - fwm logexport - https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_SecurityManagement_AdminGuid...

Have in mind that it can be time consuming and also may increase disk space usage. 

Best regards,

[PhoneBoy]

Couple issues with using fwm logexport:

• Data is not structured in a consistent format
• Since fwm logexport only works with a single log file, you'd have to iterate over each one

If you have an SIEM or even an external syslog server you can use Log Exporter to replay old logs to it. 
From there, you can extract the data you need.