SmartEvent in R80.10 MDM Environment - Is it even possible?

[Stuart_Green]

Hi,

I'm not sure if I'm losing the plot but I can't find anything in the R80.10 MDM admin guide about activating SmartEvent for an MDM environment.  The SmartEvent Server and SmartEvent Correlation Unit tick boxes are greyed out on the Domain Management Server properties and even starting SmartEvent Server & Correlation Unit via evconfig at the command line doesn't activate them.  Licenses are there on the MDSM Server.

How is this done in a MDM environment?  Surely it can't be that difficult?

TIA

[Norbert_Bohusch]

It can’t be activated on the MDM, but you have to install a separate box for SmartEvent, integrate it in global domain.

Before R80 also directly for specific domain was possible, but R80.x only supports global.

Documentation for this is in Logging Admin Guide.

[Stuart_Green]

Thanks - I was getting to that conclusion as I could see a number of other posts where a SmartEvent server was added in globally as you say.

The thing that foxes me, though, is why does the MDSM license have a SmartEvent element to it if SmartEvent can't be run on an MDSM server?

[Ruan_Kotze]

Resurrecting this thread.  I've got an Multi-Domain environment with separate management and log servers.  We now want to enable SmartEvent on the dedicated log server, but the option is grayed out.  I've gone through the logging and admin guide and can't really see why it should be grayed out.

Can one only enable SmartEvent when adding the box to your environment, as opposed to post-install?

[Ido_Shoshana]

Hi Ruan

The boxes of SmartEvent and CU should be available to be checked.

Can you share more details regarding the env configuration and order of actions?

Thanks,

Ido

[Ruan_Kotze]

Hi Ido - the error was entirely on my side.  I wanted to enable SmartEvent on a MDS Log Server, but after going through the documentation I added a dedicated SmartEvent server.

[gkhokhlov]

Hi @Ido_Shoshana , @Ruan_Kotze 

From Logging and Monitoring R81 Administration Guide: "Only a Security Management Server can also work as a SmartEvent Server. In a Multi-Domain environment, you must install SmartEvent on a dedicated server."

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitoring_AdminGuide/To...

[Ruan_Kotze]

Correct - and one shouldn't forget to add it as a correlation unit for the relevant domains as well, otherwise reports and views show up empty.