Hey Nick,
Here is more options to obtain some of the insight you're looking for with historical data.
Using the documentation: Logging and Monitoring R80.10 (Part of Check Point Infinity)
Read up more in the "traffic or system counters solution" section
To run a Traffic or System Counters view:
- In the SmartView Monitor client, select the Traffic or System Counter branch in the Tree View.
- Double-click the Traffic or System Counter view that you want to run.
A list of available gateways shows.
- Select the gateway for which you want to run the selected Traffic or System Counter view.
- Click OK.
The results of the selected view show in the SmartView Monitor client.
Recording a Traffic or Counter View
You can save a record of the Traffic or System Counter view results.
To record a traffic or counter view:
- Run the Traffic or System Counters view.
- Select the Traffic menu.
- Select Recording > Record.
A Save As window shows.
- Name the record.
- Save it in the related directory.
- Click Save.
The word Recording shows below the Traffic or Counter toolbar. The appearance of this word signifies that the view currently running is recorded and saved.
- To stop recording, open the Traffic menu and select Recording > Stop.
A record of the view results is saved in the directory you selected in step 3 above.
Play the Results of a Recorded Traffic or Counter View
After you record a view, you can play it back. You can select Play or Fast Play, to see results change faster.
To play the results:
- In the SmartView Monitor client, select Traffic > Recording > Play.
The Select Recorded File window shows.
- Access the directory in which the recorded file is kept and select the related record.
- Click Open.
The results of the selected recorded view start to run. The word Playing shows below the toolbar.
Pause or Stop the Results of a Recorded View that is Playing
- To pause the record select Traffic > Recording > Pause.
- Click Recording > Play to resume to play the Traffic or Counter view results recorded before.
- To stop the record select Traffic > Recording > Stop.
Pg 96
To creating a custom traffic view:
- In the Tree, right-click Custom and select New Traffic View.
The Query Properties window opens.
- Select History or Real Time.
- If you select Real Time, select what you want to see:
- Interfaces
- Services
- IPs / Network Objects
- QoS Rules
- Security Rules
- Connections
- Tunnels
- Virtual Links
- Packet Size Distribution
- Select the Target gateway.
- If you often need results for on gateway, select it in Specific Gateway.
- If you have a small number of gateways, you can create a custom view for each one.
- If not, select Prompt for Gateway before run.
- Open the next tabs.
The tabs that show depend on the Query Type you selected.
- If you select History, the next tab is Traffic History, where you select the Time Frame and type of report.
- If you select Real Time, the next tabs let you set services or objects to monitor, gateways or specified IP addresses to monitor, update interval, result type, and chart settings.
- Click Save.
- Right-click the new Custom view and select Rename.
- Enter a name for the view.