Administrator Localhost Log in and Log out every day

[xavmoss]

I want to ask about audit logs, every night there are logs about administrator login and logout from localhost, detailed log only show about localhost logged in from query-database and localhost logged out from query-database. What causing this log because Auditor asked about this log?

[PhoneBoy]

Can you post an example screenshot?

[xavmoss]

Attached, this happen every day

[PhoneBoy]

The logs that you are seeing is internal Check Point connections from Smart Event to the Log Server / SmartCenter Used to obtain status requests among Check Point components.
All the relevant log files should have the same pattern:
Operation:Log In;Administrator:localhost;Machine:<Machine Name>;Subject:Administrator Login;Additional Info:Authentication method: Local bind;Operation Number:10;client_ip:<IP Address>;
Those logs only shows that those action were made in the background and do not indicate there is an issue.
It is expected system behavior.

[datacenter]

We have experienced same kind of Audit logs every minute after the update to R81.20. I am attaching the screenshot.

[Chris_Atkinson]

If concerned after reviewing the full log card details please raise it for investigation with TAC via an SR.