Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
xavmoss
Explorer

Administrator Localhost Log in and Log out every day

I want to ask about audit logs, every night there are logs about administrator login and logout from localhost, detailed log only show about localhost logged in from query-database and localhost logged out from query-database. What causing this log because Auditor asked about this log?

5 Replies
PhoneBoy
Admin
Admin

Can you post an example screenshot?
xavmoss
Explorer

Attached, this happen every day

0 Kudos
PhoneBoy
Admin
Admin

The logs that you are seeing is internal Check Point connections from Smart Event to the Log Server / SmartCenter Used to obtain status requests among Check Point components.
All the relevant log files should have the same pattern:
Operation:Log In;Administrator:localhost;Machine:<Machine Name>;Subject:Administrator Login;Additional Info:Authentication method: Local bind;Operation Number:10;client_ip:<IP Address>;
Those logs only shows that those action were made in the background and do not indicate there is an issue.
It is expected system behavior.
datacenter
Explorer

We have experienced same kind of Audit logs every minute after the update to R81.20. I am attaching the screenshot.

0 Kudos
Chris_Atkinson
Employee Employee
Employee

If concerned after reviewing the full log card details please raise it for investigation with TAC via an SR.

CCSM R77/R80/ELITE
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events