Logging into a single security domain
Logging is available on all Check Point components – that is, gateways, management servers, dedicated log servers, and SmartEvent servers.
Security logs created by gateways are sent to either management servers (if they are acting as log servers), dedicated log servers, or both if so configured. Additionally, logs can be stored locally and forwarded to the management/log servers on schedule.
Audit logs are created by management servers and are stored locally. They can be forwarded to the designated log servers on schedule, too.
Logs are indexed by log servers and are accessible via SmartConsole, SmartView (browser-based access), an API, or in a raw form via the CLI using either the fw log
command or the CPLogFilePrint
command in Expert mode. The CPLogFilePrint
command, although unwieldy, returns more information. It is officially unsupported beyond logging troubleshooting but might come in handy. See the sk153972 CPLogFilePrint...