maximum days to index the offline logs

[tavi0906]

we had some issue after upgrade https://support.checkpoint.com/results/sk/sk111766 same as the mentioned sk.

here i would like to know what is the maximum number of days logs we can index ? can we plan for 365 days ?

and is there any method to read the logs which are exported to local PC ?

[PhoneBoy · Accepted solution]

The main issue with indexing 365 days worth of logs is disk space and the time it'll take.
I believe it should work, though.

Check Point log files are in a proprietary format.
You can "print" them using fw log and/or CpLogFilePrint and/or export them with fwm logexport.

[tavi0906]

Is there any method to read those exported logs ?

[tavi0906]

when  Smart - 1 is in HA , is it matter where we reindex the first ? either on primary or secondary ?

[Amir_Senn]

In index mode we can query all the servers at once, so as long as you query all the servers that can function as log servers it doesn't matter.

[tavi0906]

so, can we reindex logs on primary first and then to secondary ?

[Amir_Senn]

There's no need to index more than once, it asks all the selected log servers at once.

Indexes are created from the logs on the same machine they're stored on, to index them on another server is to copy them and change number of days to index to include range of logs. If you want log redundancy you can do that.

[PhoneBoy]

All three tools I mention produce ASCII text output, just in different forms.