GAIA WebUI Login Events Not Visible in SmartConsole Audit Logs

[Checkmate_000]

Team,

We are currently unable to see any login logs related to the GAIA WebUI (portal) of the Management Server in the SmartConsole audit logs. However, login entries for both SSH access and SmartConsole access are appearing in audit logs.

Could you please advise on why GAIA WebUI login attempts are not being recorded in the audit logs?

[the_rock]

Can you search by IP itself in audit logs? Thats what I did and showed up.

Andy

[the_rock]

This is what I meant in my first response.

Andy

[Checkmate_000]

Dear Team,

I have checked the audit logs for various customers by searching with the IP address; however, we are unable to find any logs related to WebUI logins. Could you please confirm if there are any specific settings that need to be enabled in order to capture WebUI login logs?

[the_rock]

Check my screenshot. Its my mgmt IP address.

Andy

[Checkmate_000]

I have checked using the Management IP, but I'm still unable to see any audit logs for WebUI logins. Additionally, I noticed that this is not only to the Management Server—WebUI access logs for the firewall itself are also missing from the audit logs.

[Duane_Toler]

Check your Gaia WebUI syslog settings. There's an option to send this to the Audit Log.

CLISH:

> show syslog mgmtauditlogs 
Sending audit logs to Management Serever is enabled

(apparently the typo is real... not my doing) 

Enable it with:

set syslog mgmtauditlogs on
show syslog mgmtauditlogs

This is described in the Gaia Admin documentation

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Gaia_AdminGuide/Content/Topi...

[Tal_Paz-Fridman]

Following what Duane wrote you can also check the settings in Gaia Portal

It should produce this log:

[Checkmate_000]

Dear Team,

"The setting has already been enabled, but we are still unable to see the audit logs for WebUI logins. This issue is not limited to a specific customer I have verified it across three different customers' Check Point Management Servers. In all cases, the setting is enabled, but WebUI login events are not appearing in the audit logs even if I'm searching with the Mgmt server IP.

[G_W_Albrecht]

Please open SR# with CP TAC to get this resolved asap !

[Dan_Manley]

Would you please post your fix when you get it as we have the same issue. R81.20

[G_W_Albrecht]

If CP gives a configuration hint his could be posted - but any HF has to be verified using customers cpinfo/migrate export to stay under support. You have to contact TAC to get the HF.

[mrbhenry]

Hi Checkmate_00 -

Did you ever open SR# with CP TAC and get this resolved? We are experiencing the same behavior. 

[Tal_Paz-Fridman]

Thanks @Duane_Toler  - I will move the typo issue to R&D owner to be fixed