Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Ivory

Administrator Localhost Log in and Log out every day

I want to ask about audit logs, every night there are logs about administrator login and logout from localhost, detailed log only show about localhost logged in from query-database and localhost logged out from query-database. What causing this log because Auditor asked about this log?

0 Kudos
3 Replies
Highlighted
Admin
Admin

Re: Administrator Localhost Log in and Log out every day

Can you post an example screenshot?
0 Kudos
Highlighted
Ivory

Re: Administrator Localhost Log in and Log out every day

Attached, this happen every day

0 Kudos
Highlighted
Admin
Admin

Re: Administrator Localhost Log in and Log out every day

The logs that you are seeing is internal Check Point connections from Smart Event to the Log Server / SmartCenter Used to obtain status requests among Check Point components.
All the relevant log files should have the same pattern:
Operation:Log In;Administrator:localhost;Machine:<Machine Name>;Subject:Administrator Login;Additional Info:Authentication method: Local bind;Operation Number:10;client_ip:<IP Address>;
Those logs only shows that those action were made in the background and do not indicate there is an issue.
It is expected system behavior.