Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
GeorgeF
Contributor
Jump to solution

Missing Logs - track long-lived TCP/IP connection

Hi Experts,

Recently we use TCP connection to forward syslogs from client to server (both are Linux OS). It is interesting that we can see from client and server (by TCPdump command) that the TCP connection is established and syslog data packet were forwarded/received properly.

While on the SmartConsole -> logs , we only see some intermittent logs, which should continuous ?
I thought when the client are forwarding syslogs, the data packet should be continuous( long-lived TCP/IP connection ?) I checked on the client, the logs did generate continuously.

 

I find some info from  https://support.checkpoint.com/results/sk/sk41248  , but it seems not mentioned how to track logs during long-lived TCP sessions.

Is it possible that the logs only track the TCP packet which has SYN ?  

 

Thanks very much 

Best regards

 

0 Kudos
1 Solution

Accepted Solutions
GeorgeF
Contributor

Hi,

Thanks very much for your reply.

As my understanding, it will generate a log when the TCP session is established. ( Yellow hightlighter)

 

TCP session.png

And if the connection keeps open and keeps forwarding log packets then it won't generate more logs.

Until the server or client initiate "CLOSING THE CONNECTION" , or some Time-Out triggered closing the session.

Next time when a new SYN -> SYN+ACK -> ACK established a new connection with a new source port ,  it will generate a new log.

Is it right ?  I think that would explain the intermittent logs perfectly.

 

Thanks again

 

 

 

View solution in original post

0 Kudos
3 Replies
PhoneBoy
Admin
Admin

We generate a log upon first connection.
A session may consist of multiple connections (e.g. different elements on a webpage hosted in different places) which will update the existing log entry.
Likewise, if you have Accounting logging enabled or Detailed/Extended logging, the existing entry will update every 10 minutes.
These updates will be sent via Log Exporter as well.

0 Kudos
GeorgeF
Contributor

Hi,

Thanks very much for your reply.

As my understanding, it will generate a log when the TCP session is established. ( Yellow hightlighter)

 

TCP session.png

And if the connection keeps open and keeps forwarding log packets then it won't generate more logs.

Until the server or client initiate "CLOSING THE CONNECTION" , or some Time-Out triggered closing the session.

Next time when a new SYN -> SYN+ACK -> ACK established a new connection with a new source port ,  it will generate a new log.

Is it right ?  I think that would explain the intermittent logs perfectly.

 

Thanks again

 

 

 

0 Kudos
PhoneBoy
Admin
Admin

You've got it right.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Wed 01 May 2024 @ 02:00 PM (EDT)

    South US: HTTPS Inspection Best Practices

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Wed 01 May 2024 @ 02:00 PM (EDT)

    South US: HTTPS Inspection Best Practices

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82
    CheckMates Events