Logging CMA into separate log server

[Fulcrum]

Hello,

We have remote site with SMS which we would like to import into another environment with MDM. MDM logs into MLM. However we do have requirement to keep logs of the remote site locally in that location. (geographical/compliance restrictions). Is it possible to log one domain into separate local CP log server post import (not MLM)? Or we do need to get second MLM with 1CLM for that?

Everything is on R80.10

[Tommy_Forrest]

You can define one or more primary log servers to send logs to.

This is a per gateway option.  Edit the properties of your gateway and then Logs->Log Servers.  As long as your MLM(s) are all SIC'ed and trusted then they should show up as an option.

For GAIA devices it is in the top level Logs option.

Once you've made the change, be sure to push policy.

Another option would be adding the log exporter to your MLM and then setting up a log export back to the alternate location.

[Fulcrum]

So we would need to build new MLM even if it is just for one domain. No way to configure non-MLM Check Point log server?

Log exporting back and forward over wide geography is defeating most of the purpose of having local log server.

[Martin_Raska]

I have a same question, can someone explain, please. It was possible in R77.30, but in R80.X its the limitation I think.

[Dorit_Dor · Accepted solution]

with multi domain environment of any of the released r80x versions, you can either have mlm (multi domain log server vs single domain server) OR contact the EA team to get early availability to future version that is planned to include also single log server support for muli domain environment