Audit Logs in Gaia?

[lullejd]

Hi guys  Is there a way how we can check changes done through gaia from Management Audit Logs? Thanks in advance

[Vladimir]

Yes. See my comment here: https://community.checkpoint.com/message/24885-re-gateway-cli-login-logs 

[JozkoMrkvicka]

Or CLI alternative in case webUI is disabled, or not allowed:

hostname> set syslog mgmtauditlogs on

hostname> set syslog auditlog permanent

More info in this article:

How to export syslog messages from Gaia Security Gateway to a Log Server and view them in SmartView ... 

[Danny]

Within Gaia's expert mode you can easily look for changes within audit log with this one-liner:

tail -n 200 $FWDIR/log/fw.adtlog | grep -a changed

This shows the last 200 lines of your audit log. Change the number to how many lines you want to see.

[lullejd]

*** UPDATE ****

Thanks all for your suggestions.

We have enabled logging for all Bash shell commands in Gaia following the procedure in SK99134 and forwarded syslog to an external syslog server.

Thanks all for your help