SmartView: Accessing Check Point Logs from Web

[PhoneBoy]

SmartView was added to R80, but was not enabled by default.

In R80.10, it is enabled by default and can be reached by https://management-ip/smartview/

You log in using your SmartConsole credentials.

From here, you can view the logs and see reports without using SmartConsole.

[Tomer_Sole]

With R80.20.M1 the web log viewer has more features and closes more gaps comparing to SmartLog.

• Statistics pane
• More data in the cards
• Choose the column profiles
• Right-click a log to filter the query
• Exporting to Excel lets you select the columns
• Auto-refresh views

I encourage you all to try out the web log viewer and tell us what you think.

(data is taken off Cloud Demo Mode so don't worry about it, it's not real)

[Matt_Cartlidge]

I can login ok but don't see any logs, is there something else I need enable?

[PhoneBoy]

Log indexing?

[Matt_Cartlidge]

working now thanks!

[PhoneBoy]

Did enabling Log Indexing sort it out?

[Matt_Cartlidge]

Hi - yes it did thanks, It's really fast compared to running and searching logs on a VM (I'm on a mac).

[JimmySnow]

Dear sir,

we are running R81.20 and trying to use web smartconsole/smartview to monitor traffic logs. We have one primary sms and one secondary sms, and our logs send to primary one. However, the web smartview/smartconsole only shows logs from secondary sms, and we cannot find any button/tab to  switch to primary sms.

[Daniel_Rojas]

A great news.

[Tomer_Sole]

R80.20 brings yet another change by letting you use the web-based log viewer as part of the SmartConsole application. See https://community.checkpoint.com/message/30701-how-to-switch-to-the-new-log-viewer-inside-smartconso... 

[Greg_Harbers]

In an environment where you have separate log servers from Management, is this expected to work by going to the Management server or log server? I have found that it works on the logserver IP only, is this correct?

[PhoneBoy]

Log server.

[Tim_Spencer]

This Web version version is defintely speedy. But I am jealous of the examples above. We are running R80.10 and whilst the logs display and I can query them as expected, all the other panes ie. Top Ten, Timeline say Query failed. (They all work fine in actual SmartConsole.) Is this expected or should I be raising it with TAC as it looks fine in the above example

[PhoneBoy]

As far as I know it should all work.

You should open a TAC case.

Note that SmartView has been improved pretty significantly in R80.20 as well.

[Tim_Spencer]

OK will do, thanks

[Kfir_Dadosh]

Top statistics, log-cards and profile editor are only integrated to R80.20.

That's why you didn't see them as you are running R80.10.

[Realeboga_Mashi]

At least I can use some part of the CP admin console natively from my MAC - no need to RDP to a Windows machine.

Maybe one of the good days CP will enable access from a MAC just as we can do with Windows.

[smartview]

Hi,

i am only able to login with default-admin to the webbased smartview. Every new added smartconsole-account dont work. I can connect to smartconsole but if i try webbased smartview i get "wrong username or password". User "sview" pass "qay123". If i take a wrong password - i get: authentican to server failed". The smartconsole-user has the super-user profile. Any ideas why this not work? I used a R80.20 take 101 with jumbo-ga 47. On our production system with R80.10 is works fine with every smartconsole-account.


Best Regards,
Christian

[smartview]

Hi,

an here is the solution for the problem: Newly created users cannot log in to R80.20 SmartView WebUI -> sk148794. Hotfix is needed.

Symptoms

Starting from R80.20 Jumbo HFA Take 33, newly created users fail to log in into local SmartView WebUI, receiving the "Invalid username and password" error regarding the permission level set to the user.

Cause

New users are created with a new field that does not appear on SmartView.

Best Regards,

Christian

[JozkoMrkvicka]

We are using dedicated R77.30 MDS log servers where some of the users doesn't have an account created (the local ones).
As far as I understand user management of R80.20 SmartView correctly, there is a need to have created local users in order to have access to the SmartView? In R77.30 MDS, you can simply open SmartView Tracker using SmartDashboard credentials and you are in.

If this is the case, is there a way to limit some users to access SmartView only for specific CMAs ?

Another question - Is there a way to display 24-hour format of time in SmartView? At the moment there is AM/PM format.

[JozkoMrkvicka]

In R80.20 MDS environment, if I create a user which can access ONLY specific CMA (no MDS, nor Global), I can access via SmartConsole only this specific CMA.
In case I will access SmartView via browser and log in using this user, I can access also MDS and Global Domains. Not only that one which I have specified during user creation.

[Vladimir]

Thanks for this post, it just saved me some time.

FYI: License report is failing to generate after upgrade to ongoing Take 74.

Other reports seem to be working, but I have tested a few, not all of them.

[Aurelijus]

I am new to Checkpoint but just quick check to logs - and first disappointment. In exported CSV file source field is empty when in search window I see it.

Another thing would be date format - when you have comma in your date format and at the same time as separator - not so good for import. Is it changeable somewhere?

[_Val_]

Can you clarify? CSV file is empty, but you see data in it if you search??? This does not make much sense. 

Also, what is that you are trying to achieve?

[Aurelijus]

No, CSV file is not empty but fields of source not present in the export. In GUI I can see them fine.

And another thing is the date format - why use such format which includes comma. It makes more difficult to parse or import the file.

What is usually the goal of export - to share with other team members, have ability to work on smaller piece of logs etc.

[Emil_T]

Clicking on export to csv but nothing happens. Export to CSV not working. Using firefox

[Amir_Senn]

Did the export succeed using other browsers?

[Emil_T]

Nop

[Amir_Senn]

I suggest trying a few things:

1) Try to export views/reports and see if the issue occurs for those as well.

2) Check that there's nothing relevant in the Archive folder.

3) Did you connect to the management IP or the SmartEvent (if not on the same server)? If this is distributed try to repeat the operation from the other server.

4)  You can try to restart the SmartView processes by using $RTDIR/scripts/stopSmartView ; $RTDIR/scripts/startSmartView and see if this solves the issue.

If nothing helps, perhaps the best way to continue is to open ticket for support.

[tetemkegebre]

Where is the default path for exported CSV file from Smartview.

Iam unable of getting the exported file