What is best practice for syslog sending

[TSOL]

Dear Team,

Hello.

We are setting a distributed environment with two smart-1 appliances(MGMT-HA) and two quantum appliances(Cluster_XL).

We need to send syslog to other syslog server.

In this case, should I configure Gaia or Smartconsole to send syslogs?

And I want to know the difference between syslog that can be sent from Gaia and syslog that can be sent from smartconsole.

Please let me know if you have any information.

[Chris_Atkinson]

Regarding Syslog for Security & Audit Logs the answer is:

sk122323: Log Exporter - Check Point Log Export

Weather you configure it in GAiA CLI or SmartConsole depends on the Management version & advanced nature of the config required.

The Syslog otherwise configured at the GAiA level is the system/OS logs as different to the above.

[TSOL]

Thank you for the reply.

This SK is set to send syslog from smartconsole, but is checkpoint recommended to send it from smartconsole normally?
Gaia can also send syslogs, but when would you use this?

Please let me know if you have any information.

[Chris_Atkinson · Accepted solution]

As above security logs come from management.

Local OS events direct from the Gateway.

[George_Ellis]

You would use it in Info level if you wanted to see DHCP assignments if the gateway is set to act as a DHCP server.  You can also scrub for local logins, and any critical or warnings you specifically need.  With PCI-DSS, sending these to your syslog servers allows better validation of their questions.  It is very satisfying during an audit to say, "Did you check on the syslog infrastructure?  It is there."