1

Specifically, we're using fwm logexport piped to logger to dump the audit logs in real time via syslog to our SEIM. It works great if the command is run manually (in the background) from the "expert" command line, but then we have to remember to go back in and re-start it after a reboot.

The "Job Scheduler" allows for running a job at startup time, but it doesn't allow you to enter multiple commands connected with a pipe, and it turns out that its "@startup" happens too early in the boot process for this use (before all the CP processes have started).

Gaia tends to overwrite settings that are made outside of the configuration tools, but I don't know how extensive that is, so I'm hoping there's an official place for custom scripts that won't get purged.

Rob Walsh
  • 113
  • 4

1 Answers1

2

You should check article sk87560 from Check Point, it explains a supported way how to syslog to external server. Here is a shortened explanation.

Gaia OS logs to syslog server:

HostName> add syslog log-remote-address <IP_Address> level info
HostName> show syslog all
HostName> save config

Check Point firewall logs to syslog server: (in expert mode)

[Expert@HostName]# vi /etc/rc.d/init.d/cpboot

add row to the end

 fw log -f -t -n -l  2> /dev/null | awk 'NF' | logger -p local4.info -t CP_FireWall &

So in that sense /etc/rc.d/init.d/cpboot should work for your purposes, remember to add & to the end or you might get problems with the booting process.

toottoot
  • 101
  • 6
  • That looks like it will solve my problem. Thanks! (I'll test before accepting the answer, just to keep things clean here.) – Rob Walsh Nov 06 '13 at 20:19
  • OK, this answer solves my root problem, but is not really relevant to the question as I asked it. Should I fix the question so that this is an appropriate answer? Note that I've discovered that Job Scheduler is just `cron`, and @startup happens too early (pre-cpboot) to be helpful for starting the log exporting process. – Rob Walsh Nov 07 '13 at 18:35
  • Fixed the question. A couple of notes: I think my predecessor may have actually submitted "sk87560" to be answered; I apologize for not checking for it. Also, while this method survives reboots, I suspect that it might not reliably survive an upgrade or patch (i.e., if `cpboot` gets updated). – Rob Walsh Nov 08 '13 at 18:14