Missing Logs - track long-lived TCP/IP connection

[GeorgeF]

Hi Experts,

Recently we use TCP connection to forward syslogs from client to server (both are Linux OS). It is interesting that we can see from client and server (by TCPdump command) that the TCP connection is established and syslog data packet were forwarded/received properly.

While on the SmartConsole -> logs , we only see some intermittent logs, which should continuous ?
I thought when the client are forwarding syslogs, the data packet should be continuous( long-lived TCP/IP connection ?) I checked on the client, the logs did generate continuously.

I find some info from  https://support.checkpoint.com/results/sk/sk41248  , but it seems not mentioned how to track logs during long-lived TCP sessions.

Is it possible that the logs only track the TCP packet which has SYN ?  

Thanks very much 

Best regards

[PhoneBoy]

We generate a log upon first connection.
A session may consist of multiple connections (e.g. different elements on a webpage hosted in different places) which will update the existing log entry.
Likewise, if you have Accounting logging enabled or Detailed/Extended logging, the existing entry will update every 10 minutes.
These updates will be sent via Log Exporter as well.

[GeorgeF · Accepted solution]

Hi,

Thanks very much for your reply.

As my understanding, it will generate a log when the TCP session is established. ( Yellow hightlighter)

And if the connection keeps open and keeps forwarding log packets then it won't generate more logs.

Until the server or client initiate "CLOSING THE CONNECTION" , or some Time-Out triggered closing the session.

Next time when a new SYN -> SYN+ACK -> ACK established a new connection with a new source port ,  it will generate a new log.

Is it right ?  I think that would explain the intermittent logs perfectly.

Thanks again

[PhoneBoy]

You've got it right.