You can get logs from and send logs to a third-party Log Server. The Check Point Log Server and the third party Log Server use the LEA (Log Export API) protocol to read logs. By default, the Check Point Log Server uses port 18184 for this connection. If you configure the Log Server to use a different LEA port, you must manually configure the new port on the SmartEvent Server and on the SmartEvent Correlation Unit.
Note- This procedure is not relevant if you use Log Exporter.
To change the default LEA port:
$INDEXERDIR/log_indexer_custom_settings.conf
in a text editor.:lea_port (<
new_port_number>)
cpstop
$FWDIR/conf/fwopsec.conf
in a text editor.lea_server auth_port <
new_port_number>
lea_server port 0
cpstart