cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question

How to export all result for the SmartLog query shows

Jump to solution

Hi team:

We have one requirement for log export.

SmartLog query shows many entries when scrolling down. We want to export all these entries into one csv file.

But now we only can export about 200 entries even we have near 1300 searched entries.

Logs searched result in SmartConsole

Our SmartTracker only show the currently entries in the fw.log file. Is there any solution for this requirement?

1 Solution

Accepted Solutions
Admin
Admin

Re: How to export all result for the SmartLog query shows

Jump to solution

SmartConsole will only export visible log entries.

SmartView will export up to a million entries (even if not visible).

0 Kudos
11 Replies
Danny
Pearl

Re: How to export all result for the SmartLog query shows

Jump to solution

fwm logexport

sk118002: Cannot export more than 50 records (logs) to Excel CSV in R80.XX

Solution
To export all the required logs, you can:
  • Use the legacy R80 SmartView Tracker application (CPlgv.exe) under folder C:\Program Files (x86)\CheckPoint\SmartConsole\R80\PROGRAM
0 Kudos

Re: How to export all result for the SmartLog query shows

Jump to solution

Or change in SVTracker to the older log file and export the events file by file...

0 Kudos
Maik
Silver

Re: How to export all result for the SmartLog query shows

Jump to solution

Hey,

I experienced the same issue a while ago. To be honest, it feels like a bug...

You can circumvent this issue by accessing the SmartView web application (https://mgmt_srv_ip/smartview).

Use the same syntax and export the logs within the web application - now the csv should contain all the logs and not just these that are shown on screen.

Regards,

Maik

0 Kudos
Admin
Admin

Re: How to export all result for the SmartLog query shows

Jump to solution

SmartConsole will only export visible log entries.

SmartView will export up to a million entries (even if not visible).

0 Kudos

Re: How to export all result for the SmartLog query shows

Jump to solution

If we try to export it, its size is just in KBs and empty when we open it. 

0 Kudos

Re: How to export all result for the SmartLog query shows

Jump to solution

You did try to export it from SmartView Tracker ? That should work: C:\Program Files (x86)\CheckPoint\SmartConsole\R80.10\PROGRAM\CPlgv.exe

0 Kudos

Re: How to export all result for the SmartLog query shows

Jump to solution

Dameon Welch AbernathyGünther W. Albrecht

Yep, I tried with it but it is not showing the current logs as well. There is one more limitation in searching with SmartView Tracker that we can't search it for the Inline layer rules as this feature is in R80.x but Tracker is for R77.x. 

Here is the detailed description which might help -

Symptoms:
============
Logs are Missing per rule 

Steps Taken:
============
-Rule wise logs unable to generate the .csv file is getting crash
-While login to Security Policy->Logs->unable to see the logs intermittently.
Getting the error "no logs" .
-Confirmed that when generated log report from Smart View ->logs are missing and also informed that in legacy@@ smart tracker some of the rule logs are missing.
-#cpwd_admin list -all process are UP and running .
-Having enough disk space and memory verified #df -kh and free -m
-Its listening on port 257 verified #netstat -nap | grep 257
-#tcpdump -nnei any host <Firewall IP> and port 257
Firewall is sending logs to Management Server.
-#cpinfo -y all jumbo_take_112 installed on the appliance.
-#watch -d -n 2 "ls -l $FWDIR/log/fw.log" show the logs are storing on Management Server.

0 Kudos

Re: How to export all result for the SmartLog query shows

Jump to solution

I would involve TAC here.

Re: How to export all result for the SmartLog query shows

Jump to solution

Does it have to enable log indexing for it? But I have a limitation of the hardware resources. 

0 Kudos
Admin
Admin

Re: How to export all result for the SmartLog query shows

Jump to solution

Assuming the operation involves multiple log files, I would assume so.

Sven_Glock
Silver

Re: How to export all result for the SmartLog query shows

Jump to solution

In the past I escalated a service request to have this feature in R77.30 SC and I was very happy when it was added.

With R80.10 migration I was pretty disappointed when I noticed that this feature was gone again.

From my point of view SmartView can definitivly only be a workaround.