Installing a Dedicated Log Server or SmartEvent Server

Procedure:

  		1.

    Note - You can install a dedicated SmartEvent Server and a dedicated SmartEvent Correlation Unit.

    Step

    Instructions

    1

    Install the GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Operating System:

    2

    Follow Configuring Gaia for the First Time.

    3

    During the First Time Configuration Wizard, you must configure these settings:

    • In the Installation Type window, select Security Gateway and/or Security Management.

    • In the Products window:

      1. In the Products section, select Security Management only.

      2. In the Clustering section, in the Define Security Management as field, select Log Server / SmartEvent only.

    • In the Security Management Administrator window, select one of these options:

      • Use Gaia administrator

      • Define a new administrator and configure it

    • In the Security Management GUI Clients window, configure the applicable allowed computers:

      • Any IP Address - Allows all computers to connect.

      • This machine - Allows only the single specified computer to connect.

      • Network - Allows all computers on the specified network to connect.

      • Range of IPv4 addresses - Allows all computers in the specified range to connect.

    • In the Secure Internal Communication window, enter the applicable Activation Key (between 4 and 127 characters long).

    4

    Install a valid license.

    See Working with Licenses.

  2. Step

    Instructions

    1

    Connect with SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. that works with this Log ServerClosed Dedicated Check Point server that runs Check Point software to store and process logs. or SmartEvent Server.

    2

    From the left navigation panel, click Gateways & Servers.

    3

    Create a new Check Point Host object that represents the dedicated Log Server or SmartEvent Server in one of these ways:

    • From the top toolbar, click the New () > More > Check Point Host.

    • In the top left corner, click Objects menu > More object types > Network Object > Gateways & Servers > New Check Point Host.

    • In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > Check Point Host.

    4

    Click the General Properties page.

    5

    In the Name field, enter the applicable name.

    6

    In the IPv4 Address and IPv6 Address fields, enter the applicable IP addresses.

    7

    In the Platform section:

    • In the Hardware field, select the applicable option

    • In the Version field, select R81

    • In the OS field, select Gaia

    8

    On the Management tab, select the applicable Software Blades:

    9

    Establish the Secure Internal Communication (SICClosed Secure Internal Communication. The Check Point proprietary mechanism with which Check Point computers that run Check Point software authenticate each other over SSL, for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server.) between the Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. and this dedicated Log Server or SmartEvent Server:

    1. In the Secure Internal Communication field, click Communication.

    2. Enter the same Activation Key you entered during the First Time Configuration Wizard of the dedicated Log Server or SmartEvent Server.

    3. Click Initialize. The Trust state field must show Established.

    4. Click Close.

    10

    In the left tree, configure the applicable settings.

    11

    Click OK.

    12

    In the SmartConsole top left corner, click Menu > Install database.

    13

    Select all objects.

    14

    Click Install.

    15

    Click OK.

Disk space for logs and indexes:

The Log Server or SmartEvent Server with Log Indexing enabled, creates and uses index files for fast access to log file content. Index files are located by default at $RTDIR/log_indexes/.

To make sure that there is always sufficient disk space on the Log Server or SmartEvent Server, the server that stores the log index deletes the oldest index entries when the available disk space is less than a specified minimum. The default minimum value is 5000 MB, or 15% of the available disk space.

Step

Instructions

1

In the SmartConsole, edit the object of the Security Management Server.

2

From the left navigation tree, click Logs > Storage.

3

Select When disk space is below <number> Mbytes, start deleting old files.

4

Enter the applicable disk space value.

5

Click OK.

Note - In a Multi-Domain Security Management environment, the Multi-Domain ServerClosed Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS. controls the disk space for logs and indexes. The configured disk space applies to all Domain Management Servers. Configure the applicable disk space in the Multi-Domain Server object.

For more information, see: