Exported Logs Missing Fields

[Raymond134547]

Hello,

I've configured Log Exporter on my Mgmt Server with no customizations other than the server I'm sending to and format:

This is Check Point Security Management Server R81.20 - Build 024
This is Check Point's software version R81.20 - Build 054
[SecurePlatform]
HOTFIX_GAIA_API_AUTOUPDATE
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 118

We are sending CEF over TCP.

Our rulebase uses Accounting for quite a few rules, and viewing logs in SmartConsole shows Client Inbound Bytes, Client Outbound Bytes, Server Inbound Bytes, and Server Outbound Bytes quite clearly.

However, when I capture what is being exported from the Mgmt Server, I am missing the Client Inbound Bytes and Client Outbound Bytes.  I'm still sending:

client_inbound_packets

client_outbound_packets

server_inbound_bytes

server_inbound_packets

server_outbound_bytes

server_outbound_packets

But where are my client inbound / outbound bytes in the export? I've done some lengthy captures, and that data just isn't being exported. Can anyone think of what I could be missing?

Thanks,

Ray

[Chris_Atkinson]

So no filters are applied, which read mode is used semi-unified or raw etc?

[Amir_Senn]

Which SIEM are you using?

[the_rock]

I believe @Amir_Senn actually brought up super valid point, it definitely can depend of what SIEM you ar using.