Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
gironer
Explorer

Missed "Connection" Logs data in Reports/View

When creating Reports/Views and doing some filtering we have noticed that when comes to Log Type "Connection" even though they are for sure visible in the Smart Console Logs, they are not reflected in the reports. 

For the case in particular we noticed that when comes to filters logs  (packet drops) by "first packet isn't syn"  on an report we got not date found. We know for sure logs are there even though but for some reason cannot be retrieved to the reports/views.  

We are aware that this also happens to the Log Type=Session, and this get solved by enabling on the firewall rules tracking "Per Session".  Would it be possible that the same can be done for the  Log type "Connection". All the logs we have for as first packet isn't syn"  are "Connection" log type, which of course explain the lack of data in the reports/views.

0 Kudos
1 Reply
PhoneBoy
Admin
Admin

Explicit configuration is required to use Connection logs in SmartEvent reports as these are not indexed by default.
See: https://support.checkpoint.com/results/sk/sk150452 
Depending on the volume of logs involved, this can cause additional load. 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events