How to switch to the new log viewer inside SmartConsole (and maybe get a little performance improvement)

[Tomer_Sole]

With R80.20, there are 2 user interfaces when looking at Check Point logs:

- The default viewer when opening the SmartConsole application on your Windows machine.

- The default viewer when opening the logs on your web browser.

Going forward, the web-based log viewer will set as the default log viewer in SmartConsole in some instances, creating a consistent experience whether accessing logs via the SmartConsole application or with a web browser.

The web-based log viewer is also known to work faster in some environments comparing to the default viewer (see: R80.10 Security Management - Performance Tuning Guide - Check Point Software Technologies  and search for the part that discusses "SmartConsole")

There are still a few limitations to the web-based log viewer comparing to the other one, such as:

1. It doesn't support logs that aren't indexed (SmartView Tracker-style)

2. The main page for Logs & Monitoring does not have a link to open Compliance overviews.

Starting with R80.20, you can change the default log viewer in SmartConsole.

1. Make sure SmartConsole is closed.

2. Open the folder where SmartConsole is located at. For example: C:\Program Files (x86)\CheckPoint\SmartConsole\R80.20\PROGRAM or the folder where you extracted Portable SmartConsole

3. In this folder, find the file SmartConsole.exe.config

4. Change the following value from "False" to "True":

<add key="Accessibility" value="False"/>

5. Open SmartConsole. Notice that all the log viewers and log bottom panes look different and have the "SmartView" brand.

You don't need a SmartEvent license for this capability.

Once again I want to remind you on the limitations which include not being able to work with Compliance or older non-indexed logs. This feature is in early-available mode.

Tell us what you think about the new viewer in the comments below.

[HeikoAnkenbrand]

Nice!

Regards

Heiko

[Sven_Glock]

I like it! I am very happy to see that the timeline is back!

But! The time line causes "query failed" error when selecting a specific time range.

Only restarting the SmartConsole helps to get back to the logs.

Should I open an SR for this?

Cheers

Sven

[Sven_Glock]

The predefined filters are very nice.

I am missing the automatic completion of the querysyntax and there are no links to sandblast reports in the logs

[18568]

Unless I missed something there is no automatic completion at all in this interface (completion of query like Sven said above but also just object names completion), so I had to switch back the old interface.

It is a shame because the new interface is clearly nicer (and maybe a little bit faster).

[HristoGrigorov]

I like it. Needs a bit of a polishing but in general it is better than before.

Btw, time appearance isn't respecting Windows system setting.