Questions on Log Exporter

[Cypress]

Log Exporter was set up by my predecessor so I'm just trying to get caught up to speed.  In my environment it looks like it was set up via the CLI, because if I log into the Security Management Server expert mode and I use these commands, I will see that we have a log exporter set up and active.

cp_log_export status

cp_log_export show name {name}

However, in the SmartConsole GUI, if I double click our Security Management Server, and go to Logs > Export, it is blank and shows nothing configured.

My first question is: is that normal?  (The mismatch between CLI and GUI)  I am assuming this is normal because my predecessor used the "configure via CLI" option instead of GUI?

My second question is that I'm being asked to set up a new log exporter, because we are evaluating new SIEM products.  Is it fine to leave the original one in place and simply add a new one via 'cp_log_export add name' command, and filling out the required fields? Is it supported to have two (or more) simultaneous exporters like this? Any concerns with resource consumption?

[PhoneBoy · Accepted solution]

Yes, this is expected behavior since, in past versions, it was only possible to configure via CLI.
You can have multiple exporter configurations defined. 

[the_rock]

It is normal, 100%.

[the_rock]

 if below helps as well.

Andy

Solved: Log exporter TLS config with QRadar - Check Point CheckMates

Re: Log Exporter exporting to splunk - Check Point CheckMates

[Bob_Zimmerman]

I would configure any new exporters in SmartConsole. For that matter, I also recommend moving the CLI config into SmartConsole. That way, it's all included in your migrate export or mds_backup files. Less stuff to remember to do if your management fails and you have to rebuild it.