Smartview log export

[dkzndkqh]

I understand that in SmartView, the number of logs that can be exported at one time is currently limited to 1,000,000. Is there any way to work around this limitation? We are currently dealing with a ransomware incident and need to perform a full log investigation, so even if we filter the logs, exporting just one day’s worth would exceed 1,000,000 logs in just one hour. Alternatively, is there a more effective method to handle this?

[Tal_Paz-Fridman · Accepted solution]

Perhaps CLI options might work:

https://support.checkpoint.com/results/sk/sk118519

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityManagement_AdminGuide/Cont...

https://support.checkpoint.com/results/sk/sk118521 

[Blason_R]

Did you try with mgmt_cli? I always export the logs using the same filter and then using jq with csv its the faster one

[dkzndkqh]

Could you share the commands or filters you are using?

[Blason_R]

The filters are same as you give on smartlog command would be 

For example to filter port 587

mgmt_cli show logs new-query.time-frame "today" new-query.filter "service:TCP_587 AND blade:Firewall"

Output in json

mgmt_cli show logs new-query.time-frame "today" new-query.filter "service:TCP_587 AND blade:Firewall" --format json > /tmp/test.json

 Then edit with jq or jq -r to get the desired output in csv

Or Directly convert those in csv using cplgv.exe from  C:\Program Files (x86)\CheckPoint\SmartConsole\R82\PROGRAM and select export option to choose log file name

or if you want to specifically select then

use fw log command for particular log file from $FWDIR/log and then fitler the traffic for Accept or Drop or use grep accordingly

[dkzndkqh]

What I want to do right now is extract data such as Time, Destination, Source User Name, Rule, Interface Direction, Policy Rule UID, Type, Interface, Source User DN, Machine Name, App Protocol, context_num, Policy Date, Service ID, Action, ID, Interface Name, Layer Name, Source Port, Product Family, Blade, Direction of Connection, lastupdatetime, Sequence Number, Source, Policy Name, id_generated_by_indexer, Database Tag, Log Server Origin, Service, connection_id, Origin, Marker, Destination Port, Protocol, High Level Log key, logid, sig_id, User, first, Policy Management, Destination Machine Name, and I want the values to be properly aligned in the corresponding columns when opened in Excel, just like when exporting from SmartView. Is that possible?

[Blason_R]

Then you should  use cplgv and export in csv

OR do that for every file then

fw log -l -n -p   /opt/CPsuite-R81.20/fw1/log/2025-09-03_000000.log  > /tmp/test.log

[dkzndkqh]

ChatGPT의 말:

When I run fw log , the file size ends up being in the gigabyte range.  is that right ..?

[the_rock]

Might be worth TAC case to confirm.

[Bob_Zimmerman]

That seems small. For me, 'fwm logexport' usually goes from a 2 GB original file to about 35 GB of text. I wrote a post a while ago about how I deal with exported log data.

[the_rock]

Gb range, sounds right.

[Lesley]

Log exporter -> https://support.checkpoint.com/results/sk/sk122323

In combination -> how to export old logs with log exporter -> https://support.checkpoint.com/results/sk/sk183376

[PhoneBoy]

Having SmartView export more than 1 million records at a time is an RFE.

Repeated, tightly scoped queries to the get-logs API endpoint piped through jq can format the output in CSV, if you want to go that route.
Not sure it's possible to specify a date range in the query in SmartView (maybe @Tomer_Noy knows).