Viewing the Audit Log File (show smo log auditlog)

Description

Use the "show smo auditlog filter" command in Gaia gClishClosed The name of the global command line shell in Check Point Gaia operating system for Security Gateway Modules. Commands you run in this shell apply to all Security Gateway Module in the Security Group. to see the contents of the auditlog file.

This log file contains an entry for each change made to the SGM configuration database with GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. gClish or other commands.

The auditlog file for each SGM is located in the /var/log/ directory.

The log contains two types of activities:

Activity

Description

Permanent

The activity permanently changes the configuration database on the SGM hard disk.

Transient

The activity changes the configuration database in SGM memory, which does not survive reboot.

Syntax

show smo log auditlog [filter <String>] [from [<N>]] [to [<N>]] [tail [<X>]]

Parameters

Parameter

Description

filter <String>

Specifies a word or phrase , by which to filter the output.

from <N>

Shows logs filtered by the time range (number of seconds).

to <N>

Shows logs filtered by the time range (number of seconds).

tail <X>

Shows only the last X lines of the log file for each SGM.

For example, "-tail 3" shows only the last 3 lines of the specified log file.

Default: 10 lines.

Note - Each entry contains one of these characters:

  • p +

    Means a permanent action that added or changed an item in the configuration database.

  • p -

    Means a permanent action that deleted an item in the configuration database.

  • t +

    Means a transient action that added or changed an item in the configuration database in memory only.

  • t -

    Means a transient action that deleted an item in the configuration database in memory only.

Example filter

This example shows only permanent actions to save the configuration.

[Expert@MyChassis-ch0x-0x:0]# gclish
[Global] MyChassis-ch01-01 > show smo log auditlog filter update_status
Oct 19 03:19:30 1_02  admin localhost p +installer:update_status -1
Oct 19 03:19:32 1_02  admin localhost p -installer:update_status -1
Oct 19 03:19:32 1_02  admin localhost p +installer:update_status 0
Oct 19 03:19:45 1_06  admin localhost p +installer:update_status -1
Oct 19 03:19:46 1_06  admin localhost p -installer:update_status -1
Oct 19 03:19:46 1_06  admin localhost p +installer:update_status 0
Oct 19 03:20:00 1_07  admin localhost p +installer:update_status -1
Oct 19 03:20:01 1_07  admin localhost p -installer:update_status -1
[Global] MyChassis-ch01-01 >