disable logging of identity awareness (ia agent / broker) session events

[Vincent_Bacher]

Hi mates,

We are currently in the process of reducing the huge amount of logs that we have to process all the time.
One point here is the mass of identity awareness session events, such as log in, log out, session received from broker and so on.
Since we have almost 100k authenticated IA Agent / Terminal Server Agent sessions at peak times, this results in a mass of events, especially since each update generates three log entries (Access Layer PDP, Core Layer PDP and Domain Layer PDP).

Is there a way to deactivate these events? Maybe someone has had this challenge before.

Thanks
Vincent

[PhoneBoy]

Just to be clear, we’re talking about security logs in Check Point and not in Windows, right?
A few examples (with sensitive details redacted) might not be a bad idea to understand the kinds of logs you’d like to see suppressed.

[Vincent_Bacher]

---

@PhoneBoy wrote:

Just to be clear, we’re talking about security logs in Check Point and not in Windows, right?

---

Exactly. 

Sure. See screenshot

[PhoneBoy]

@Liel_Shaish is there a way to disable/tune down the logs here?