Deployment of Log Exporter using API

Starting from R82.10, you can configure Log Exporter using the Check Point Management API.

Best Practice - Use API-based configuration for all R82.10 and later environments.

Example API command for creating a Log Exporter:

mgmt_cli add log-exporter name "newLogExporter" target-server "1.2.3.4" target-port 1234 protocol "tcp" attachments.add-link-to-log-attachment true --format json

Example API command for creating a Log Exporter with all filtering options:

This example shows how to create a Log Exporter with multiple filtering rules. The exporter forwards only logs that match the specified criteria.

mgmt_cli add log-exporter name "allFilterModesExporter" target-server "10.20.30.40" target-port 514 protocol "udp" filters.expressions-operator "and" filters.filter-out-connection-logs true filters.expressions.1.field-name "action" filters.expressions.1.operator "in" filters.expressions.1.values.1 "Accept" filters.expressions.1.values.2 "Drop" filters.expressions.1.values.3 "Reject" filters.expressions.2.field-name "src" filters.expressions.2.operator "not-in" filters.expressions.2.values.1 "10.0.0.1" filters.expressions.2.values.2 "10.0.0.2" filters.expressions.3.field-name "severity" filters.expressions.3.operator "and" filters.expressions.3.conditions.1.operator "neq" filters.expressions.3.conditions.1.value "Low" filters.expressions.3.conditions.2.operator "neq" filters.expressions.3.conditions.2.value "Informational" filters.expressions.4.field-name "bytes" filters.expressions.4.operator "or" filters.expressions.4.conditions.1.operator "eq" filters.expressions.4.conditions.1.value "0" filters.expressions.4.conditions.2.operator "gt" filters.expressions.4.conditions.2.value "1000" filters.expressions.4.conditions.3.operator "lt" filters.expressions.4.conditions.3.value "100" --format json

Explanation:

  • expressions-operator - Combines multiple field-based filters by using logical operators, such as "and" or "or".

  • filter-out-connection-logs - Removes connection logs.

  • Include only logs where the action is Accept, Drop, or Reject:

    filters.expressions.1.field-name "action" 
    filters.expressions.1.operator "in" 
    filters.expressions.1.values.1 "Accept" 
    filters.expressions.1.values.2 "Drop" 
    filters.expressions.1.values.3 "Reject"

  • Exclude logs where the source IP is 10.0.0.1 or 10.0.0.2:

    filters.expressions.2.field-name "src"
    filters.expressions.2.operator "not-in"
    filters.expressions.2.values.1 "10.0.0.1"
    filters.expressions.2.values.2 "10.0.0.2"

  • Include only logs in which severity is neither "Low" nor "Informational":

    filters.expressions.3.field-name "severity"
    filters.expressions.3.operator "and"
    filters.expressions.3.conditions.1.operator "neq"
    filters.expressions.3.conditions.1.value "Low"
    filters.expressions.3.conditions.2.operator "neq"
    filters.expressions.3.conditions.2.value "Informational"

  • Include logs in which bytes are 0, greater than 1000, or less than 100:

    filters.expressions.4.field-name "bytes"
    filters.expressions.4.operator "or"
    filters.expressions.4.conditions.1.operator "eq"
    filters.expressions.4.conditions.1.value "0"
    filters.expressions.4.conditions.2.operator "gt"
    filters.expressions.4.conditions.2.value "1000"
    filters.expressions.4.conditions.3.operator "lt"
    filters.expressions.4.conditions.3.value "100"

For complete API syntax and parameter description, see the Management API Reference Guide.