SmartEvent storage depth

[Nadezhda]

Logging of events on CheckPoint equipment is organized using SmartEvent server. Event log viewing is performed using the Security Management Server console (software versions on both serversR81.10). However, the event storage depth is no more than 2-3 days, which does not meet the current needs.

How can we increase the event storage depth on CheckPoint SmartEvent server to 15-30 days?

[G_W_Albrecht]

sk111766: R80.x & above SmartLog/SmartEvent server doesn't index/show logs older than 1-14 days back

[Nadezhda]

Yes, we have seen that sk, thanks, but in $RTDIR/log_indexes we also contain logs longer than 3 days, so it probably doesn't fit for us

[G_W_Albrecht]

Then ask CP TAC !

[the_rock]

I agree with @G_W_Albrecht ...if that sk does not help, TAC is your next avenue.

Andy

[Amir_Senn]

Different indexes cores could have different definitions. You can check $FWDIR/conf/log_policy.C for advanced options. There's a chance that the logs are available but indexes are not, you can check it by trying to open log file manually of older dates and see if you can see the event in this mode (which is non-index mode).

Also, you should check log retention definitions on the SmartEvent server itself. If the server is short on storage it might trigger emergency log cleanup and might explain why this isn't available.

[Chris_Atkinson]

What is the storage capacity / utilisation of the machine?