External syslog solution

[jfischer]

I am looking for a recommendation on an external syslog solution which can capture the log entries for forensic purposes.

[PhoneBoy]

This is more of an "Off Topic" question 🙂

Your favorite Linux distribution includes a syslog server, either as part of the install or is installable (e.g. syslog-ng)
In the very distant past, I've used Kiwi Syslog on Windows, which appears to now be owned by Solarwinds.
For other options, I defer to the rest of the community. 

[jfischer]

I should clarify, I am trying to get to Smart-1 Cloud but the logging retention is only 90 days based upon the calculations.  I need a solution to store log files 4-7 years (based upon who you ask).  The hosted solutions were outside the scope of what could be justified.  The logs need to roll into some sort of cold storage solution but Checkpoint has not got around to that solution.

[the_rock]

We use siem elastic, its awesome. Not sure what is longest log retention, but will ask one of colleagues in that team.

[PhoneBoy]

Some of the SKUs in the Product Catalog actually state a 90-day retention time for logs.
You can purchase longer retention using the SKU: CPSM-EVENTS-EXT-RET12M-1Y (this extends it to 1 year).

If you're going to export from Smart-1 Cloud (would have been a good thing to mention up-front), you will need to have one or more of the following SKUs: CPSM-CLOUD-1GB-LOGEXP-1Y
You should also consider using something known to work with Log Exporter (what we use on the backend): https://support.checkpoint.com/results/sk/sk122323 

Strongly suggest working with your local Check Point office on this to ensure you get the solution that will best meet your needs.

[the_rock]

Splunk is good for that.