- CheckMates
- :
- Products
- :
- Quantum
- :
- Management
- :
- Re: Unable to Export Huge logs on .csv
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unable to Export Huge logs on .csv
Hi All,
How can we export a huge logs that at least this year? We tried to export on infinity portal smart 1 cloud. We can see that there is an option to export up to 1K, 10K, 100K up to 1M logs. We choose 1M logs because we target to export all logs at least this year. When we download the generated CSV file exported it only shows 1000 logs not 1M or higher. Also all the logs are the logs on the same day. How can we achieve exporting all the logs?
Thank you
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As Andy wrote you can see the limitation here under Logs & Monitor:
Expected Behavior and Known Limitations (checkpoint.com)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you open a TAC case on this? https://help.checkpoint.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, We still can't export it, There are missing logs on whole month.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You will never see more than 1000 logs, its a limitation, TAC confirmed through case we had for a customer. Its ONLY for S1C, not vm or physical appliance (I tested in my VM, had 900K logs exported)
Andy
Page 57
* Export logs to Excel CSV is limited to 1K records
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
okay, is there a way to export all the logs even not on .csv?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The only answer TAC told us to that question is to get all .log files exported, but what you can do with them, they never clarified.
Problem is, they would need to get those for you, since customers dont have ssh access to S1C instance.
Andy
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
best is to investigate this with TAC
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From memory something like this used to be a limit of SmartConsole UI that you could workaround only with SmartView (web).
How much existing retention do you have within your Smart-1 cloud instance to begin with?
Note the log storage limits & expansion options outlined in the Smart-1 Cloud data sheet.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have the exact same problem. The log export function has the behavior as if it was exported directly from the Smart Dashboard, the exported registers are the only that have been browsed.
As you have the same Check point subscription (Infinity portal, Smart-1), can you check if you can open SmartView using the option located in the "logs & Monitor New tab" (botton left)? They have the option but is not working. I opened a TAC case and they gave me the option (and only option) to use the new Logs & Events option (at that time) but, of course, is not working. It will open a tab in your default Internet browser with this address https://127.0.0.1:19008/smartview/.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you check my previous post, its a limitation, even in S1C portal. 1M logs option works, but only on regular on-prem management or VM, not Smart-1 cloud.
Even TAC confirmed this via the case we had opened for a customer.
Best regards,
Andy
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As Andy wrote you can see the limitation here under Logs & Monitor:
Expected Behavior and Known Limitations (checkpoint.com)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So, we don't have any option for all of we that have the service on the cloud??
I remember it once worked, perhaps they removed that option.
I have a log server on prem, that would help (smartview does work there) but, I still have problems trying my centrally managed SMBs to send logs to it. They try to send to its maas ip address, of course is not routable from other branches.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As it states in the document, limit is 1K logs, though in GUI, it shows you can export up to 1M, but you canNOT.
Anyway, I know this is 100% true, as I tested it myself.
Best regards,
Andy
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Too bad. Hope there will be an option soon.
In order to keep our access rules clean, we need to check history logs and remove or rearrange the access, you know security is a most.
Thanks Andy for your kind attention.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Trust me, I hear you. I was equally as shocked to find this limitation, its unfortunate is there, but lets hope they fix it soon.
Andy
