Installing a Log Server or SmartEvent Server

You can install a dedicated Log Server or SmartEvent Server on Check Point appliances or Open Servers.

To install a Log Server or SmartEvent Server:

1. In the Gaia First Time Configuration Wizard, on the Products page, select Products > Security Management > Define Security Management as: > Log Server/SmartEvent only.

   Note - Do not select Security Gateway.

2. Click Next.
3. After you move forward and get to the Secure Internal Communication (SIC) page, define the Activation Key. Use this key to configure the object of a dedicated Log Server or SmartEvent Server in SmartConsole.

The Security Management Server or Log Server with log indexing enabled, creates and uses index files for fast access to log file content. Index files are located by default in the $RTDIR/log_indexes/ directory.

To make sure that there is always sufficient disk space on the server, the server that stores the log index deletes the oldest index entries when the available disk space is less than a specified minimum. The default minimum value is 5000 MB, or 15% of the available disk space.

To change the minimum available disk space for logs and indexes:

1. In SmartConsole, edit the Security Management Server or Log Server or SmartEvent network object.
2. From the Gateways & Servers double-click an object. The Check Point Host window opens.
3. Click Logs > Storage.
4. Select When disk space is below <number> Mbytes, start deleting old files.
5. Change the disk space value.
6. Click OK.

   Note - In a Multi-Domain Security Management environment, the disk space for logs and indexes is controlled by the Multi-Domain Server, and applies to all Domain Management Servers. Configure the disk space in the Multi-Domain Server object.