Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Stuart_Green
Collaborator

SmartEvent in R80.10 MDM Environment - Is it even possible?

Hi,

I'm not sure if I'm losing the plot but I can't find anything in the R80.10 MDM admin guide about activating SmartEvent for an MDM environment.  The SmartEvent Server and SmartEvent Correlation Unit tick boxes are greyed out on the Domain Management Server properties and even starting SmartEvent Server & Correlation Unit via evconfig at the command line doesn't activate them.  Licenses are there on the MDSM Server.

How is this done in a MDM environment?  Surely it can't be that difficult?

TIA

7 Replies
Norbert_Bohusch
Advisor

It can’t be activated on the MDM, but you have to install a separate box for SmartEvent, integrate it in global domain.

Before R80 also directly for specific domain was possible, but R80.x only supports global.

Documentation for this is in Logging Admin Guide.

0 Kudos
Stuart_Green
Collaborator

Thanks - I was getting to that conclusion as I could see a number of other posts where a SmartEvent server was added in globally as you say.

The thing that foxes me, though, is why does the MDSM license have a SmartEvent element to it if SmartEvent can't be run on an MDSM server?

Ruan_Kotze
Advisor

Resurrecting this thread.  I've got an Multi-Domain environment with separate management and log servers.  We now want to enable SmartEvent on the dedicated log server, but the option is grayed out.  I've gone through the logging and admin guide and can't really see why it should be grayed out.

Can one only enable SmartEvent when adding the box to your environment, as opposed to post-install?

0 Kudos
Ido_Shoshana
Employee
Employee

Hi Ruan

The boxes of SmartEvent and CU should be available to be checked.

Can you share more details regarding the env configuration and order of actions?

 

Thanks,

Ido

0 Kudos
Ruan_Kotze
Advisor

Hi Ido - the error was entirely on my side.  I wanted to enable SmartEvent on a MDS Log Server, but after going through the documentation I added a dedicated SmartEvent server.

0 Kudos
gkhokhlov
Employee
Employee

Hi @Ido_Shoshana , @Ruan_Kotze 

From Logging and Monitoring R81 Administration Guide: "Only a Security Management Server can also work as a SmartEvent Server. In a Multi-Domain environment, you must install SmartEvent on a dedicated server."

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitoring_AdminGuide/To...

 

Ruan_Kotze
Advisor

Correct - and one shouldn't forget to add it as a correlation unit for the relevant domains as well, otherwise reports and views show up empty.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events