SMB security log files - Check Point CheckMates

SMB security log files

The SMB locally managed appliances have a nice log interface, similar to SmartLog. But it is not possible to export the security logs to a text file as commands fw log or fwm logexport are not available on Embedded GAiA. But we can do that easily if we have a GAiA SMS available:

• from the /var/log/log/local/0/ directory we copy the file cp.log
• we rename it to e.g. 2018-01-01-750000.log (it is important to adhere to this naming convention)
• we copy this file to GAiA SMS directory /opt/CPsuite-R80.20/fw1/log/
• we issue the command fw repairlog /opt/CPsuite-R80.20/fw1/log/2018-01-01-750000.log to rebuild the pointer files
• after that, it is possible to use SmartLog on the file when it is opened
• also SmartView Tracker can open the file and export it as text
• commands fw log and fwm logexport are now available

But be careful: After opening the file in SVTracker and exporting, it will vanish from the log folder...

CCSP - CCSE / CCTE / CTPS / CCME / CCSM Elite / SMB Specialist

Tags:

• exporting logs
• smb