A few things to be aware of.
Firstly - The answer to the question you asked is No. The logs are not forwarded.
If you have a SmartEvent server (Dedicated Log Server (DLS) is configured to be the primary log server for the gateways/clusters then they will send the Firewall logs to the DLS (the SmartEvent server but lets just call it the DLS).
The gateways need to be configured to do that manually otherwise they continue to use the SMS as the primary log server, even after the DLS is introduced (as a new Check Point Host).
If you configure the gateways to "Send Syslog messages to management server" (the tick box in the Gaia portal) then they send to the Primary log server (according to the gateway configuration).
Secondly - I believe this is still true, although it does not appear in the last two versions documentation (R81.20 and R82):
"Send Syslog messages to management server" --> "Gaia OS system messages are logged through the Check Point logging infrastructure when the option Send Syslog messages to management server is enabled in the Gaia WebUI or clish.
These logs are handled by fwd and delivered to the Security Management Server / Log Server over TCP port 257, where they are stored as native Check Point log records and displayed in SmartConsole."
FWD is a critical process on the gateway. It handles many things, including blade logs (firewall logs).
It may be better to separate the logs and send the Linux (Gaia) to a separate syslog server by configuring --> Gaia - System TLS Configuration or --> Remote System Logging.
It does depend though on your solution and the size, performance and exact requirements.
If you had a lot of resources and did not mind seeing syslog messages mixed in with the firewall (and other blade) logs then the 'Send Syslog messages to management server' could be a good solution.
One benefit is that the syslog messages are encrypted by FWD (as part of SIC (Secure Internal Communications)) because that is how it handles all the logs it sends to the log server.
Third - Andy sent you the Log Exporter configuration screen shots.
The Log Exporter is a separate solution that takes the Check Point proprietary logs (firewall and other blade logs) which the Check Point log server received from the Check Point Gateways gateways and translates then into syslog (or the chosen format (Splunk etc.)) and then sends them to the 3rd party.
That satisfies the 3rd party SIEM solution that some customers prefer as a centralized logging/monitoring solution.
It also helps to translate the non-syslog/proprietary Check Point logs into syslog.
Lastly - A Check Point Log Server can forward its log files to another Check Point Log Server.
If you had a DLS and it was the primary log server for the gateways but then it went down then the gateways may use the Primary SMS as the log server (if it is configured as their secondary log server). Later, when the DLS comes back up the gateways will sense that and automatically switch back. The SMS can be configured to forward the logs to the DLS so that they will go to the DLS.
You will see all the logs on all of the servers in the SmartConsole because it connects to all of the log servers' indexes.
In the Logs tab (LOGS & MONITORING / LOGS & EVENTS (R82)) you will see a Log Servers tab (on the right hand side) and in there you will see all of the Check Point management (log) servers are selected by default.
So the Log Forwarding is for moving log files around.
You only need to play with it/test it and you will see all the options.
PS. This is also covered in the CCSE course - https://igs.checkpoint.com/courses/3125
Check out the CPLogInvestigator command below, in case it is useful.
References:
https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_LoggingAndMonitoring_AdminGuide/Co...
https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_Gaia_AdminGuide/Content/Topics-GAG...
https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_LoggingAndMonitoring_AdminGuide/Co...
https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_LoggingAndMonitoring_AdminGuide/Co...
https://support.checkpoint.com/results/sk/sk98126
CPLogInvestigator:
https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_CLI_ReferenceGuide/Content/Topics-...
Hope that helps.
