- Local User Groups
@Maarten_Sjouw a quick google search shows RFC5424 is simply syslog protocol (I didn't know this off top of head).
answer: yes. check the "formats" section below.
I've now tried this, and also contacted TAC. LogExporter cannot be used on a dedicated SmartEvent appliance. Logexporter currently does not support indexed logs, however TAC told me that this is in the pipeline.
interesting to hear this (and thanks for posting update).
It's my understanding the Log Exporter is a service that works directly on Log Server (whever that may reside).
I do understand the requirement for SmartEvent users to push alerts into 3rd party system (SIEM, SOC, etc) and it does make sense that CP would leverage something like Log Exporter for this (and replace the current duct tape and bailing wire methods).
I'm still working with TAC on this, but in my case the objective is to send log data for specific gateways and for TP only which maybe managed by different domain servers to a central SIEM collector for the organisation.
My logic was, rather then burdening the Provider with multiple streams to the collector, send logs from the SmartEvent appliance for the specific gateways (single stream) and logs are already consolidated for TP events. In this way only filtering to do now and in the future would be to maintain the list of GWs in the filter.
Clearly not happening...well not yet.
which version is this? Did you try other filters?
I'd guess it's not supported on your version.
see log-exporter sk122323 for supported versions:
R80.30 log server (with smartevent ) +
HOTFIX_R80_30_JHF_T111_LOGRHYTHM_MAIN Take: 4
I'm having problems filtering log_export while the pipe between CP and Splunk is working.
I find it very easy to throw away a feature without customers being able to easily apply it, especially when the feature has been expected for months.
The documentation is confusing and we always have to spend a monster amount of time with expert support to get through it.
at this point basic questions remain:
- following the advanced configuration given as an example, the FilterConfiguration.xml file is fed by the commands but still no filters on the exported logs and I receive the access type logs from the firewall.
I am sorry to hear that it took long time to configure Log Exporter and filtering feature.
I would like to help you and guide you so you will be able to use this feature ASAP.
Could you please send me email and we will take it from there? my email address is email@example.com
Are there any plans for this to be configured with a GUI interface? As mentioned by others this process is not as straight forward as it is made out to be. For something that should be a "configure once" scenario it takes a lot of wasted time to configure. Having a GUI front end where you could select what fields from what blades you wanted to export and what SIEM you were using which would then ensure that the correct formatting and configurations were applied would be a lot more customer friendly.
Filtering does not work properly. I had a call open with Checkpoint for a month trying to get this configured and it still isn't. We just decided to give up in frustration because the Checkpoint resource didn't know what to do either. I spent days more on my own trying to work through it. When you have a lot of other work to do it's frustrating to have to spend valuable time trying to work out something like this that should be straight forward.
We had to configure export all and then blacklist because some fields weren't being passed through with the "export none" and whitelist approach. This means long winded xml files need to be created to filter out all unwanted fields.
If i try to use the whitelist approach the rule fields (rule_uid, rule_name,etc) don't come through. If i try to use the blacklist approach the layer_uuid, layer_name, etc.. and other fields don't filter out.
It would be great to just be able to tick some boxes and have the logs files flow through to the SIEM in the correct format. This would also save your staff valuable time trying to troubleshoot customer issues.
Thanks for reaching us.
Regarding your issues:
1. UI for Log Exporter is part of our plan. I am not sure exactly what features will be included in the first version but we will try our best to support as most as possible features of Log Exporter. For unsupported features by UI, it is still possible to configure them manually.
2. Regarding your issue with the filtering, I do sorry to hear you spent so much time in it and I would like to help.
Can we you please send me an email (firstname.lastname@example.org) an we will take it together from them?
I will be also glad to hear a feedback so we can improve it.
There is a general theme here.
I've gone through the same pains as well; the documentation is not very clear, all of which has been fed back to TAC.
In an MDS setup I've noted that UDP traffic that should be using a CMA's IP actually uses the lead IP of the MDS to send traffic (By design I'm told...yeah right!)
If you specify TCP then the correct source IP is used (by design!).
I set up cp_log_export to send FW logs to splunk but no data is being sent
Expert@fw-logsrv:0]# tail -f log_indexer.elg
[log_indexer 86745 3915397952]@fw-logsrv[28 Apr 16:16:44] Sent current: 0 average: 0 total: 0
[log_indexer 86745 3915397952]@fw-logsrv[28 Apr 16:16:49] Files read rate [adtlog] : Current=0 Avg=0 MinAvg=0 Total=5 buffers (0/0/0/0)
[log_indexer 86745 3915397952]@fw-logsrv[28 Apr 16:16:49] Sent current: 0 average: 0 total: 0
[log_indexer 86745 3915397952]@fw-logsrv[28 Apr 16:16:54] Files read rate [adtlog] : Current=0 Avg=0 MinAvg=0 Total=5 buffers (0/0/0/0)
[log_indexer 86745 3915397952]@fw-logsrv[28 Apr 16:16:54] Sent current: 0 average: 0 total: 0
[log_indexer 86745 3915397952]@fw-logsrv[28 Apr 16:16:59] Files read rate [adtlog] : Current=0 Avg=0 MinAvg=0 Total=5 buffers (0/0/0/0)
[Expert@fw-logsrv:0]# cp_log_export show
[Expert@fw-logsrv:0]# cp_log_export status
status: Running (41112)
last log read at: 28 Apr 17:56:15
debug file: /opt/CPrt-R80.30/log_exporter/targets/splunk_log/log/log_indexer.elg
I also saw this message below in log_indexer.elg
log_indexer 86745 4127701376]@fw-logsrv[28 Apr 15:38:51] FormatConfiguration::init: formatHeaderFile is not configured for type: splunk, applying default : conf/SplunkFormatDefinition.xml
Thanks for you response. Ironically i did manage to get it working a coupe of hours after i left the post. I ended up deleting it entirely and starting from scratch. I also found a post from Yonatan that specifically mentioned about configuring the layer_uuid filtering.
I look forward to seeing the GUI interface for the solution
I'm trying to configure filter in my syslog profile. I only want to send the logs from/to sprcific subnet. I have configure as below but it doesn't send the syslog.
<field name="src" operator="or">
<field name="dst" operator="or">
I have restarted but it doesnt works.
Please advise is there anything I missed out ?
I have a 1450 appliance Version R77.20.85 (990172755)
How can I get the configuracion log exporter for this appliance? I see that sk 122323 is for R77.30 and above.