80.10 and SmartLog queries

[Rick_Isbell]

I have been using CheckPoint firewalls for about 6 years and since day 1 have thought that they 'did it right' for both the firewall admin and the security analyst.  However, the lack of flexibility to get data, reports, and alerts out of the SmartLog and SmartEvent makes we want to rip it out and put in a Linksys with Kiwi syslogging.

For example, why does (NOT protection_type:"blockbycountries") give me all logs except for geo-location ones, and (protection_type:"blockbycountries") returns nothing?

I feel that 80.10 is a SERIOUS step backwards in regards to logging, monitoring, & event analysis.  I previously used R75.40, R77.30, and even NGSE and was able to create a detailed view of the inbound and outbound traffic on a daily basis.  Now, the exported log output shows a handful of columns whereas the older versions had dozens.

If I am missing something can someone please shed some light on it? 

[Kaspars_Zibarts]

I'm with you on this Rick. Have seen really strange "behaviour" of the log search, for example searching /24 subnet returns nothing but entering a specific host in the same subnet suddenly displays lots of logs. There are more examples, but at the moment our biggest issue is the speed of the search that intermittently grinds to halt. We have increased RAM and CPU and it run for a while but eventually it came back. We managed to isolate one scenario where running API script on MDS that was creating large groups of subnets pretty much stopped log search ability on MLM. Case has been open for over a month with very little progress. 

[Vincent_Bacher]

How many gateways and how many events do you have per day to make your smartcenter too slow?

[Kaspars_Zibarts]

Rough estimate 30 gateways, not too sure about the day but I know over 15k events total per second on ave, so if guestimate over 1000M events

[Vincent_Bacher]

Well. 15 K/sec sounds quite much. Would be interesting what output the CPinvestigator would deliver

[Vincent_Bacher]

Just a handful of columns? When I have a look at the columns which can be displayed in a custom profile, they are much more than just a handful.

[Yaakov_Ohayon]

Hi Rick,

Your question is super important to me as the product owner, and would like to talk to you about your experience.

please send me your contacts and timezone so we can schedule a phone call.

my email is: yaakovo@checkpoint.com