Who rated this post

this tells you what you want.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/FWG...

• est Practice - The SAM Policy rules consume some CPU resources on Security Gateway. Set an expiration for rules that gives you time to investigate, but does not affect performance. Keep only the required SAM Policy rules. If you confirm that an activity is risky, edit the Security Policy, educate users, or otherwise handle the risk.

• Logs for enforced SAM rules (configured with the fw sam command) are stored in the $FWDIR/log/sam.dat file.

  By design, the file is purged when the number of stored entries reaches 100,000.

  This data log file contains the records in one of these formats:

  <type>,<actions>,<expire>,<ipaddr>

  <type>,<actions>,<expire>,<src>,<dst>,<dport>,<ip_p>

• SAM Requests are stored on the Security Gateway in the kernel table sam_requests.

• IP Addresses that are blocked by SAM rules, are stored on the Security Gateway in the kernel table sam_blocked_ips.