Two KBs regarding how to collect log from Checkpoint and Juniper:
1. Configuring SmartCenter to send logs to syslog server
Solution ID: sk33423
Proceed as follows:
a. On the SmartCenter server edit the /etc/syslog.conf file and add the following line:
local4.info <TAB> @IP_OF_REMOTE_BOX
b. Add the following line to the end bottom of /etc/rc.d/init.d/cpboot file, to be executed on boot up:
fw log -ftnl 2> /dev/null | awk ‘NF’ | logger -p local4.info -t Firewall &
The ‘&’ in the command syntax ensures that this command runs in the background. If the ‘&’ is not included in the command, the OS stops at loading the syslogd service and you never get a login prompt at the console.
For more information about the fw log command, refer to the R75 Command Line Interface (CLI) Reference Guide.
Note: cpstop/cpstart is insufficient to make this work.
2.NSM can forward NSM logs as well as device traffic logs via syslog, SNMP, e-mail or even a custom script.
You need to define this in “Action Manager” from the NSM GUI client.
Check this KB article:
NSM Administration Guide the chapter “Forwarding Logs”:
- Login to NSM GUI
- Go to “Action Manager” and click “Action Parameters”
- Fill in the Syslog server IP address and the Syslog facility that NSM will categorize the logs as.
- Click “OK”
This informs NSM that an external Syslog server is available for use. Two mode are available to forward logs to Syslog.
The criteria can be based on category, sub-category and severity and will apply to all logs received.
Policy Manager Mode: Allows finer control on which traffic log will be forwarded to Syslog by adding the “Log action” to the desired rule options. This allows forwarding of traffic logs to Syslog only for the desired rules. Enable “Syslog” under “Log/Count” rule options for each rule.
Login to the NSM system that is managing the IDP
- Edit the IDP device and go to Report Settings
- Configure the Syslog server as shown below and update the device