- CheckMates
- :
- Products
- :
- Quantum
- :
- Management
- :
- 80.10 and SmartLog queries
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
80.10 and SmartLog queries
I have been using CheckPoint firewalls for about 6 years and since day 1 have thought that they 'did it right' for both the firewall admin and the security analyst. However, the lack of flexibility to get data, reports, and alerts out of the SmartLog and SmartEvent makes we want to rip it out and put in a Linksys with Kiwi syslogging.
For example, why does (NOT protection_type:"blockbycountries") give me all logs except for geo-location ones, and (protection_type:"blockbycountries") returns nothing?
I feel that 80.10 is a SERIOUS step backwards in regards to logging, monitoring, & event analysis. I previously used R75.40, R77.30, and even NGSE and was able to create a detailed view of the inbound and outbound traffic on a daily basis. Now, the exported log output shows a handful of columns whereas the older versions had dozens.
If I am missing something can someone please shed some light on it?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm with you on this Rick. Have seen really strange "behaviour" of the log search, for example searching /24 subnet returns nothing but entering a specific host in the same subnet suddenly displays lots of logs. There are more examples, but at the moment our biggest issue is the speed of the search that intermittently grinds to halt. We have increased RAM and CPU and it run for a while but eventually it came back. We managed to isolate one scenario where running API script on MDS that was creating large groups of subnets pretty much stopped log search ability on MLM. Case has been open for over a month with very little progress.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How many gateways and how many events do you have per day to make your smartcenter too slow?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Rough estimate 30 gateways, not too sure about the day but I know over 15k events total per second on ave, so if guestimate over 1000M events
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well. 15 K/sec sounds quite much. Would be interesting what output the CPinvestigator would deliver
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just a handful of columns? When I have a look at the columns which can be displayed in a custom profile, they are much more than just a handful.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Rick,
Your question is super important to me as the product owner, and would like to talk to you about your experience.
please send me your contacts and timezone so we can schedule a phone call.
my email is: yaakovo@checkpoint.com
