smartevent and logging server question

[Daniel_Kavan]

Hi,

We have two separate managers.    Each manager manages 5 gateways.   However, we just have one smartevent and logging server  running on one VM.    Is it possible to connect BOTH managers up to the same smartevent and logging server?   Or do they each have to have their own dedicated smart event and logging servers.  My guess they each need their own, but I wanted to double check with new capabilities in R80.30 and R80.40.

[Maarten_Sjouw]

You could try to run CP-Logexporter on 1 of the 2 and move the logs that way to the other management server and with that to the SmartEvent server. I know it is a crazy idea but it might even work.
Only other way is indeed adding another SmartEvent server.

[Amir_Senn]

AFAIK log exporter won't work.

If looking at each other logs isn't an issue you can use the following sk on "How to enable SmartEvent to read logs from external Security Management Server / externally managed Log Server". This way you can watch the logs on the SmartEvent machine and use SmartView as well.

This and creating dedicated admin to be able to only read logs and using SmartEvent will allow you to use the same SmartEvent.

sk35288: 

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...