- Products
- Learn
- Local User Groups
- Partners
- More
Check Point Jump-Start Online Training
Now Available on CheckMates for Beginners!
Why do Hackers Love IoT Devices so Much?
Join our TechTalk on Aug 17, at 5PM CET | 11AM EST
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
ZTNA Buyer’s Guide
Zero Trust essentials for your most valuable assets
The SMB Cyber Master
Boost your knowledge on Quantum Spark SMB gateways!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
Hi,
I'm not sure if I'm losing the plot but I can't find anything in the R80.10 MDM admin guide about activating SmartEvent for an MDM environment. The SmartEvent Server and SmartEvent Correlation Unit tick boxes are greyed out on the Domain Management Server properties and even starting SmartEvent Server & Correlation Unit via evconfig at the command line doesn't activate them. Licenses are there on the MDSM Server.
How is this done in a MDM environment? Surely it can't be that difficult?
TIA
It can’t be activated on the MDM, but you have to install a separate box for SmartEvent, integrate it in global domain.
Before R80 also directly for specific domain was possible, but R80.x only supports global.
Documentation for this is in Logging Admin Guide.
Thanks - I was getting to that conclusion as I could see a number of other posts where a SmartEvent server was added in globally as you say.
The thing that foxes me, though, is why does the MDSM license have a SmartEvent element to it if SmartEvent can't be run on an MDSM server?
Resurrecting this thread. I've got an Multi-Domain environment with separate management and log servers. We now want to enable SmartEvent on the dedicated log server, but the option is grayed out. I've gone through the logging and admin guide and can't really see why it should be grayed out.
Can one only enable SmartEvent when adding the box to your environment, as opposed to post-install?
Hi Ruan
The boxes of SmartEvent and CU should be available to be checked.
Can you share more details regarding the env configuration and order of actions?
Thanks,
Ido
Hi Ido - the error was entirely on my side. I wanted to enable SmartEvent on a MDS Log Server, but after going through the documentation I added a dedicated SmartEvent server.
Hi @Ido_Shoshana , @Ruan_Kotze
From Logging and Monitoring R81 Administration Guide: "Only a Security Management Server can also work as a SmartEvent Server. In a Multi-Domain environment, you must install SmartEvent on a dedicated server."
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitoring_AdminGuide/To...
Correct - and one shouldn't forget to add it as a correlation unit for the relevant domains as well, otherwise reports and views show up empty.
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY