Checking Logs from the CP CLI

[Matlu]

Hello, Guys.

Is it possible to see the traffic logs through the CLI of a FW, and not from the SmartConsole?

I want to see the traffic of a flow, for the last 7 days, at the moment of executing the command (if possible).

SOURCE IP: 192.168.59.180
IP DESTINATION: 10.100.100.5
Service: 88
Days: Last Week

If it is possible to print the log in the CLI, could you please share the syntax with an example?

I don't have access now to the SmartConsole, so I want to try to see if there are relevant logs, standing on the same FW.

Greetings.

[emmap]

The logs aren't stored on the gateways*, they get generated and sent to the log servers. There is an API available for pulling logs from the log server that you can use from its CLI.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_LoggingAndMonitoring_AdminGu...

*Unless the log server is offline.

[HeikoAnkenbrand]

Hi @Matlu,

you can use the following command:

fw log -l -b "June 12, 2024 12:33:00" "June 12, 2024 15:34:00" | grep <IP or other parameter>

or the management API (Management API Reference) - here is an example:

mgmt_cli show logs new-query.time-frame "today" new-query.max-logs-per-request "2" new-query.filter "blade:Threat Emulation"  --format json

In both cases, you still need to adjust your filters.

[Matlu]

Hi,

The command #fw log....... command, can it be executed in the same GW?
Or is it only executed in the SMS?

How can you be sure if the GW is really generating logs?

Greetings.

[Lloyd_Braun]

cpstat fw -f log_connection will show if you're connected to the log server and how many logs you're sending.

you used to be able to run 'fw log -flnt' on the gateway to dump fw.log file to stdout and "tail" it for new logs. not sure if this still works, or may only work if you are disconnected from the log server so the firewall is logging locally.

[PhoneBoy]

fw log is executed where the logs are stored (not the gateway unless the connection to management/log server is down).
The cpstat command @Lloyd_Braun should tell you what you want.

[the_rock]

@HeikoAnkenbrand gave the best option, in my opinion.

Otherwise, you can check /var/log/messages files or $FWDIT/log/fw.log file

Andy