Log exporter - filter traffic for only for VPN blade

[Supporto_Checkp]

Good morning,

Is it possible, through log exporter, to export only VPN ? If so, how would the command be? (the FilterConfiguration.xml)

Thank you

[Amir_Senn]

You can run 'filter blade in' as a command in expert mode: cp_log_export set name <name> filter-blade-in "value"

You can follow the Log Exporter SK in the relevant section for filtering for further information:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Supporto_Checkp]

Hi Amir,

the SK only menton "VPN-1 & Firewall-1" that would be "Firewall logs"- i want to filter only VPN logs - how the filter should be?

Thnaks 

Best Regards

[Dror_Aharony]

Add this to your FilterConfiguration.xml to filter by VPN logs only:

<field name="fw_subproduct" operator="or">
<value operation="eq">VPN-1</value>
</field>

file should look like this:

<filters>
<filterGroup operator="and">
<field name="action" operator="and">
</field>
<field name="origin" operator="and">
</field>
<field name="product" operator="and">
</field>
<field name="fw_subproduct" operator="or">
<value operation="eq">VPN-1</value>
</field>
</filterGroup>
</filters>

[Herschel_Liang]

If I want to filter AV, IPS and IPSEC VPN, Mobile access VPN, how the filter should be? THX!

[Dror_Aharony]

cp_log_export set name <your_name> filter-blade-in "TP,Access,Mobile" and then filter-out using (vim <TargetExporterDir>./conf/FilterConfiguration.xml) the specific blades you're sure you don't need.
Alright?

[Adity12]

Does this configuration can i do on R80.20 Take 101? or i should upgraded to latest JHF to get filtering, when i want use Log exporter?

Thanks 

[Chris_Atkinson]

R80.20 JHF Take 103 or above.

[Adity12]

So for default configuration this file, there is no filtering right?

i don't see this section <field name="fw_subproduct" operator="or">
<value operation="eq">VPN-1</value>
</field> 

so for default configuration all log will exported right?

[PhoneBoy]

Yes, everything should be exported by default.

[Adity12]

Thanks @PhoneBoy for explanation.