Log Exporter for Endpoint Policy server

[RossM]

Does anyone know if log exporter works with the Endpoint Policy server?

I have set the log exporter settings for our 2 mgmt servers and 1 policy server and whilst the mgmt servers are sending logs successfully the policy server is not sending anything.  Running "cp_log_export show" shows as enabled and all config matches on all 3 servers   I have run a tcpdump and there is nothing going to the log server.  Is this because all the logs from the policy server are passed to the mgmt server and this is expected behaviour or is there an issue with my log exporter configuration?

We are running R80.40 on all three servers.

Thanks,

Ross.

[_Val_]

Do you have logs stored on the Policy server, or are they forwarded to MGMT servers?

[RossM]

Yes they are all being passed to the mgmt server and nothing is saved locally.

Would this include logs for connecting to the policy server via ssh or the Gaia web portal as well?

[PhoneBoy · Accepted solution]

Log Exporter only runs on the management/log server.
Operating System logs are not included, and you set syslog up in the Gaia WebUI/clish to forward those logs.

[RossM]

That's great.  Thanks for the confirmation