Check Point MDS / Gateway Logs

[Logger]

Hello

I'm trying to onboard Check Point logs at the moment and could need some help.

The goal is to send all Logs to a Syslog server and then bring them into a log pipeline.

As I understand Check Point has two log sources: traffic and security logs are exported from the MDS log server with "cp_log_export" and the audit logs and device logs from the gateways are configured with the clish syslog commands. Is that correct?

Now I face these problems:

Is there a way to send gateway (GAIA) logs via TCP or even syslog over TLS?

Can you export the "cp_log_export" via syslog but still use the Splunk app?

Can you configure multiple syslog servers in active / passive mode. That you don't have duplicated logs but the logs get sent when one syslog server fails?

Thanks a lot for the help.

Cheers

[_Val_]

Please read sk122323, you should have all the answers there

[Dror_Aharony · Accepted solution]

Yes to most questions & please read the log-Exporter sk (sk122323), as Val suggested.

to answer your last question:
"Can you configure multiple syslog servers in active / passive mode. That you don't have duplicated logs but the logs get sent when one syslog server fails?"

Not exactly, an HA/Backup like system for log-exporting (cp_log_export) is not currently available. You can simply send simultaneously to 2 different syslog servers = duplication.
BUT assuming you have 2 different log-servers when one is a backup Log-Server for 1 GW (you can configure that), then you can configure both to export to same syslog server.
and only once the backup LS starts actually logging (once Primary Log-Server is down for any reason), it'll actually export these logs.
that is a sort-of backup active/passive log-exporter, but it depends on the base Log-Server receiving the logs.

Hope that helped.