Unable to Export Huge logs on .csv

[ivanfsei123]

Hi All,

How can we export a huge logs that at least this year? We tried to export on infinity portal smart 1 cloud. We can see that there is an option to export up to 1K, 10K, 100K up to 1M logs. We choose 1M logs because we target to export all logs at least this year. When we download the generated CSV file exported it only shows 1000 logs not 1M or higher. Also all the logs are the logs on the same day. How can we achieve exporting all the logs?

Thank you

[PhoneBoy]

Did you open a TAC case on this? https://help.checkpoint.com 

[ivanfsei123]

Yes, We still can't export it, There are missing logs on whole month.

[the_rock]

You will never see more than 1000 logs, its a limitation, TAC confirmed through case we had for a customer. Its ONLY for S1C, not vm or physical appliance (I tested in my VM, had 900K logs exported)

Andy

https://dl3.checkpoint.com/paid/a7/a74c8ae8160656e6004fc31f086c10cb/CP_Check_Point_Quantum_Smart-1_C...

Page 57

* Export logs to Excel CSV is limited to 1K records

[ivanfsei123]

okay, is there a way to export all the logs even not on .csv?

[the_rock]

The only answer TAC told us to that question is to get all .log files exported, but what you can do with them, they never clarified.

Problem is, they would need to get those for you, since customers dont have ssh access to S1C instance.

Andy

[_Val_]

best is to investigate this with TAC

[Chris_Atkinson]

From memory something like this used to be a limit of SmartConsole UI that you could workaround only with SmartView (web).

How much existing retention do you have within  your Smart-1 cloud instance to begin with?

Note the log storage limits & expansion options outlined in the Smart-1 Cloud data sheet.

[Emilio_Espinosa]

I have the exact same problem. The log export function has the behavior as if it was exported directly from the Smart Dashboard, the exported registers are the only that have been browsed. 

As you have the same Check point subscription (Infinity portal, Smart-1), can you check if you can open SmartView using the option located in the "logs & Monitor New tab" (botton left)?  They have the option but is not working. I opened a TAC case and they gave me the option (and only option) to use the new Logs & Events option (at that time) but, of course, is not working.  It will open a tab in your default Internet browser with this address https://127.0.0.1:19008/smartview/.

[the_rock]

If you check my previous post, its a limitation, even in S1C portal. 1M logs option works, but only on regular on-prem management or VM, not Smart-1 cloud.

Even TAC confirmed this via the case we had opened for a customer.

Best regards,

Andy

[Chris_Atkinson · Accepted solution]

As Andy wrote you can see the limitation here under Logs & Monitor:

Expected Behavior and Known Limitations (checkpoint.com)

[Emilio_Espinosa]

So, we don't have any option for all of we that have the service on the cloud?? 

I remember it once worked, perhaps they removed that option. 

I have a log server on prem, that would help (smartview does work there) but, I still have problems trying my centrally managed SMBs to send logs to it. They try to send to its maas ip address, of course is not routable from other branches. 

[the_rock]

As it states in the document, limit is 1K logs, though in GUI, it shows you can export up to 1M, but you canNOT.

Anyway, I know this is 100% true, as I tested it myself.

Best regards,

Andy

[Emilio_Espinosa]

Too bad. Hope there will be an option soon.

In order to keep our access rules clean, we need to check history logs and remove or rearrange the access, you know security is a most.

Thanks Andy for your kind attention.  

[the_rock]

Trust me, I hear you. I was equally as shocked to find this limitation, its unfortunate is there, but lets hope they fix it soon.

Andy