Extend log space with log forwarding

[Oleg_Ershov]

Hi,

My 64000 generate a huge logs. It sends logs to standby Management server R80.40 . I have an idea to shedule log forwarding once a week to active Management server in order to search more logs. Will the logs be automaticaly indexed after forwarding? Will the old logs be automaticaly deleted in order to free disk space for new forwarded logs as happens with logs received from gateway? 

Best regads,
Oleg

[Lesley]

I would spin up a new unit with more disk space and get rid of the EOL r80.40 asap. 

After that you can look into feature called: Dynamic Log Distribution

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_LoggingAndMonitoring_AdminGu...

[Oleg_Ershov]

Thank you. The problem is not perfomance, but disk space.

[emmap]

Logs will be indexed as they land on the logging instance.

Old logs will be automatically deleted per the log storage configuration on the logging instance.

I'm not sure that this will achieve what you want to achieve though. Where are you scheduling the log fowarding? Is the issue that you can't search back far enough in your logs?

[Amir_Senn]

Hi,

This will not be indexed on landing. Servers by default will index log files that were closed in the last day.

Since you're planning to do it weekly, you need to change values on the server using this SK: https://support.checkpoint.com/results/sk/sk111766

Index will not be deleted on the server and it will still take disk space.

I have a few suggestions in general for log policy:

a. Since you have large volume of logs I would add log forwarding on all GWs if not defined already.

b. Indexing entire week of logs could be resource consuming, I would suggest doing it nightly to distribute stress on primary MGMT. Nightly will not require you changing the number of days to index using the SK.

c. Set up log retention policy for all log servers. For example, if you forward all the logs from secondary after a week, you can select in log retention to delete indexes older than 7 days.

d. In general I would research other options for log server. I think that stressing active management server with large volume of logs is not recommended. 2 leading options IMO are dedicated log server and LaaS (logs as a service, stores logs on the cloud using Infinity Portal https://portal.checkpoint.com/)