Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
RedPill15
Participant

IPS Update Email Alert

Hi,

May i know how can i setup an Email alert when IPS update is failed using  SmartEvent?

 

Thank you.

Labels (1)
0 Kudos
9 Replies
G_W_Albrecht
Champion
Champion

See Logging and Monitoring Administration Guide R80.30 p.63ff !

0 Kudos
RedPill15
Participant

@G_W_Albrecht  Thanks, so do you mean there's no default options for it but  I need to create an external script instead?

0 Kudos
G_W_Albrecht
Champion
Champion

No, you create an SE automatic reaction - look at the long description in Logging and Monitoring Administration Guide R80.30 p.63ff !

0 Kudos
Amir_Senn
Employee
Employee

You need to create a custom event and find the logs that describe the failure to upgrade. It's not easy but I found something. Please note that this is the reason I created on my lab and your reason for failure may differ. This is why it's important to see a failure log in your env.

Try to set type Control and description/reason to "Could not download from "http://updates.checkpoint.com/WebService/services/DownloadMetaDataService?wsdl". Server error occurred."

Capture.PNG

 After you're defined this correctly you can add auto-reaction for this.

Kind regards, Amir Senn
G_W_Albrecht
Champion
Champion

Yes, that is a more detailed descripton of how to achieve that 😎

0 Kudos
RedPill15
Participant

Based on the log that I found, I tried to create the event as below to trigger the event however I didn't receive any email alert for this. Any advice? (checked mail alert configuration is fine)

Screenshot_2.pnge?

Screenshot_5.png

thanks.

0 Kudos
Amir_Senn
Employee
Employee

This is for a successful update.

SmartEvent has an issue creating new audit events. If you created it from scratch it won't work. If you want to create an audit event, go to an existing event, right click -> Properties , edit your event and save as a new event.

Kind regards, Amir Senn
0 Kudos
RedPill15
Participant

Thank you Amir but unfortunately  it couldn't solve the problem also. I tried to filter  "Administrator equal to admin for Any product" only for the customized event but there's no any related email alert.

Any suggestions for the filter settings ?

Thanks.

0 Kudos
Amir_Senn
Employee
Employee

I suggest going to an existing event, such as 'Check Point administrator login at irregular hours' (under 'Unauthorized Entry'), right click -> properties.

Under <Any>, change the 'Subject Equal' to 'IPS Update' and delete the 'General Information Equal' from filters. Also change radio button to 'Any Condition'.

If this doesn't work you can try same thing with 'Operation' 'IPS Update' instead/in addition to 'Subject Equal'.

Kind regards, Amir Senn
0 Kudos