Remote vpn login logs are rewrite after authentication timeout (R80.20)

[andquesada]

Hi,

I hope someone can help me with the next issue;

When remote vpn users connect to office, we can see the login log; however when authentication timeout is reached and they put back the credentials they can connect without problem; but the first login log doesn´t  appers and just appers the new login connection; is like the log was rewrited.

 This log was from 5/5/2020 (first login)

and then, after reauthentication the first login log doesn´t appear just the new login.

In firewall rule I´m using all the track options but still not working.

Is a distributed environment with a dedicated smartevent server all in R80.20.

Thanks in advance

[Timothy_Hall]

Try unchecking "Per Session" in your Track options for that rule, I think that is what is consolidating/amending your logs.

[andquesada]

Thanks Timonthy;
I´ve already tried the following combinations:
1) Log + per connection : Failed
2) Log + per connection + per session : Failed
3) and the last one was: Log + per connection + per ssesion :Failed
Now I´m gonna use your suggestion and wait for reauthentication time waiting a good new.

[andquesada]

Hi @Timothy_Hall ;

I did what you suggested; but the log still is being overwritten.

First Login was yesterday at 7:49:39; 

Then after user´s reauthentication the log is overwritten

Any other recommendation?

Thanks in advance for your help

[PhoneBoy]

Sounds like expected behavior but it might be worth a TAC case.

[lucafabbri365]

Hello guys,
I'm experiencing (it seems) the same behavior posted here: Mobile Access Log In and Log Out.

I opened a support ticket because, even if "expected", it doesn't make sense to me: why re-writing a past log entry ?!? Logs, in general, shouldn't be touched once written, isn't it ?

Bye,
Luca

[andquesada]

Hi @lucafabbri365 

I apologize because I put the SmartEvent was in R80.20; the SmartEvent version is R80.10; the cluster and mgmt are in R80.20

Anyway, before open a TAC case I put the last Jumbo hotfix for R80.10 (take_272) and today I did a the same test and now it works  as it should.

 The first  login log

And now I see the login action of the re-authentication. I´m not sure why it appers as correlated and not as simple log but now the log is not overwrite.

 I suggest you to do the same; Jumbo HF Take_141 is the last jumbo HF for R80.20 and you said you has Take 80; so maybe  It could help you.

[lucafabbri365]

Hello @andquesada,
thank you for your suggestion.

We planned to install last Hotfix in GA (141) next 20th of May; there are some bug fixed routing around "log" world, so maybe it will be solved too.

I'll update this post.

Thank you,
Luca

[lucafabbri365]

Hello All,
just an update regarding this post: I finished to install hotfix 141 (Check Point R80.20); I'll monitor the behavior for a couple of days: I'll let you know if it solved.
I'm still waiting for an answer by Check Point support.

Bye,
Luca

[lucafabbri365]

Hello Community,

this morning I didn't find log-in event (blade:"Mobile Access") occurred yesterday morning for a user; maybe substituted by log-in event occurred yesterday afternoon. This issue doesn't occur every day: looking at previous events, for the same user, log-ins events are there, untouched: I can find occurred both in the morning and in the afternoon.

However hotfix 141 didn't fix the issue. I updated support ticket with these information and waiting for an answer.

Bye,
Luca

[lucafabbri365]

Hello guys,

I have another question regarding logs in general (let me know if it would be better to open another CheckMates post): referring to Mobile Access logs (blade:"Mobile Access") I see "duplicated" log entries (same Time, same Source, same User, same Mobile Access Session UID) coming from both active and standby firewall nodes  (Origin column); it happens for SOME users only, WHY ? I don't think it is a "normal" behavior because it happens for SOME users only (not ALL), not always.

Thank you,
Luca