Working with Syslog Servers

Introduction

Syslog (System Logging Protocol) is a standard protocol used to send system log or event Record of a security or network incident that is based on one or more logs, and on a customizable set of rules that are defined in the Event Policy. messages to a specific server, the syslog server.

The syslog protocol is enabled on most network devices, such as routers and switches.

Syslog is used by many log analysis tools. If you want to use these tools, make sure Check Point logs are sent to from the Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. to the syslog server in syslog format.

Check Point supports these syslog protocols: RFC 3164 (old) and RFC 5424 (new).

These features are not supported: IPv6 logs and Software Blade Specific security solution (module): (1) On a Security Gateway, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities. logs.

Configuring Security Gateways

By default, Security Gateway logs are sent to the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server..

You can configure Security Gateways to send logs directly to syslog servers.

Important - Syslog is not an encrypted protocol. Make sure the Security Gateway and the Log Proxy are located close to each other and that they communicate over a secure network.

Procedure

Define syslog server objects in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on..
Instructions
1. Connect with SmartConsole to the Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..
2. From the left navigation panel, click Gateways & Servers.
3. Create the Host object that represents the Syslog server host.
  1. In the Object Explorer, click New > Host.
  2. Configure these fields:
    
    Name - Enter a unique name.
    
    IPv4 address - Enter the correct IPv4 address of the syslog server.
    
    IPv6 address - Optional: Enter the correct IPv6 address of the syslog server. This requires the IPv6 Support be enabled on the Security Gateway / each Cluster Member Security Gateway that is part of a cluster..
  3. Click OK.
4. Create the Syslog Server object that represents the Syslog server:
  1. In the Object Explorer, click New > Server > More > Syslog.
  2. Configure these fields:
    
    Name - Enter a unique name.
    
    Host - Select an existing host or click New to define a new computer or appliance.
    
    Port - Enter the correct port number on the syslog server (default = 514).
    
    Version - Select BSD Protocol or Syslog Protocol.
  3. Click OK.
5. Close the Object Explorer.
Select the configured syslog server objects in the Security Gateway / Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. object.
Instructions
1. Double-click the Security Gateway object.
2. From the left tree, click Logs.
3. In the Send logs and alerts to these log servers table, click the green (+) button to select the Syslog Server object(s) you configured earlier.
  
  Notes:
  - You can configure a Security Gateway / Cluster Member to send logs to multiple syslog servers.
    
    All syslog servers selected in the Security Gateway / Cluster object must use the same protocol version: BSD Protocol or Syslog Protocol.
  - You cannot configure a Syslog server as a backup server.
4. Click OK.
5. Install policy.

Configure the logging properties of the Security Gateways / each Cluster Member.

The kernel parameter fwsyslog_enable optimizes logging performance in environments that require high log rates.

Enable this kernel parameter only if explicitly instructed by Check Point Support.

fwsyslog_enable=0: Firewall logs are sent to the Syslog Server through the user space Syslog daemon (this is the default).
fwsyslog_enable=1: Firewall logs are sent to the Syslog Server directly from the Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. OS kernel.

Note - In a Cluster, you must configure each Cluster Member in the same way.

To see the current state of the fwsyslog_enable parameter

Connect to the command line on the Security Gateway / each Cluster Member.
Log in to the Expert mode.

Run:

fw ctl get int fwsyslog_enable

Output:

"fwsyslog_enable = 0" means that Firewall logs are sent to the Syslog Server through the user space Syslog daemon (this is the default).
"fwsyslog_enable = 1" means Firewall logs are sent to the Syslog Server directly from the Gaia OS kernel.

To set the state of the fwsyslog_enable parameter to (1) permanently (survives reboot)

Connect to the command line on the Security Gateway / each Cluster Member.
Log in to the Expert mode.

Edit the $FWDIR/boot/modules/fwkern.conf file:

vi $FWDIR/boot/modules/fwkern.conf

Add this line:

fwsyslog_enable=1
Save the changes in the file and exit the editor.
Reboot the Security Gateway / each Cluster Member.

To set the state of the fwsyslog_enable parameter to (0) permanently (survives reboot)

Connect to the command line on the Security Gateway / each Cluster Member.
Log in to the Expert mode.

Edit the $FWDIR/boot/modules/fwkern.conf file:

vi $FWDIR/boot/modules/fwkern.conf

Do one of these actions:
- Set the value of the kernel parameter to 0:
  
  fwsyslog_enable=0
- Delete the entire line:
  
  fwsyslog_enable=1
Save the changes in the file and exit the editor.
Reboot the Security Gateway / each Cluster Member.