Working with Syslog Servers

Introduction

Syslog (System Logging Protocol) is a standard protocol used to send system log or eventClosed Record of a security or network incident that is based on one or more logs, and on a customizable set of rules that are defined in the Event Policy. messages to a specific server, the syslog server.

The syslog protocol is enabled on most network devices, such as routers and switches.

Syslog is used by many log analysis tools. If you want to use these tools, make sure Check Point logs are sent to from the Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. to the syslog server in syslog format.

Check Point supports these syslog protocols: RFC 3164 (old) and RFC 5424 (new).

These features are not supported: IPv6 logs and Software BladeClosed Specific security solution (module): (1) On a Security Gateway, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities. logs.

Configuring Security Gateways

By default, Security Gateway logs are sent to the Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server..

You can configure Security Gateways to send logs directly to syslog servers.

Important - Syslog is not an encrypted protocol. Make sure the Security Gateway and the Log Proxy are located close to each other and that they communicate over a secure network.

Procedure

  1. Define syslog server objects in SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on..

    1. Connect with SmartConsole to the Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..

    2. From the left navigation panel, click Gateways & Servers.

    3. Create the Host object that represents the Syslog server host.

      1. In the Object Explorer, click New > Host.

      2. Configure these fields:

        • Name - Enter a unique name.

        • IPv4 address - Enter the correct IPv4 address of the syslog server.

        • IPv6 address - Optional: Enter the correct IPv6 address of the syslog server. This requires the IPv6 Support be enabled on the Security Gateway / each Cluster MemberClosed Security Gateway that is part of a cluster..

      3. Click OK.

    4. Create the Syslog Server object that represents the Syslog server:

      1. In the Object Explorer, click New > Server > More > Syslog.

      2. Configure these fields:

        • Name - Enter a unique name.

        • Host - Select an existing host or click New to define a new computer or appliance.

        • Port - Enter the correct port number on the syslog server (default = 514).

        • Version - Select BSD Protocol or Syslog Protocol.

      3. Click OK.

    5. Close the Object Explorer.

  2. Select the configured syslog server objects in the Security Gateway / ClusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. object.

    1. Double-click the Security Gateway object.

    2. From the left tree, click Logs.

    3. In the Send logs and alerts to these log servers table, click the green (+) button to select the Syslog Server object(s) you configured earlier.

      Notes:

      • You can configure a Security Gateway / Cluster Member to send logs to multiple syslog servers.

        All syslog servers selected in the Security Gateway / Cluster object must use the same protocol version: BSD Protocol or Syslog Protocol.

      • You cannot configure a Syslog server as a backup server.

    4. Click OK.

    5. Install policy.

  3. Configure the logging properties of the Security Gateways / each Cluster Member.

    Note - In Cluster, you must configure each Cluster Member in the same way.

    The fwsyslog_enable kernel parameter enables or disables the Syslog in Kernel feature on Security Gateways:

    • Value 0 = Disabled (default)

    • Value 1 = Enabled

    You can enable or disable the Syslog in Kernel feature temporarily (until the Security Gateway reboots), or permanently (survives reboot).

    1. Connect to the command line on the Security Gateway / each Cluster Member.

    2. Log in to the Expert mode.

    3. Run:

      fw ctl get int fwsyslog_enable

      Output:

      • "fwsyslog_enable = 0" means the feature is disabled (default)

      • "fwsyslog_enable = 1" means the feature is enabled

    1. Connect to the command line on the Security Gateway / each Cluster Member.

    2. Log in to the Expert mode.

    3. Run:

      fw ctl set int fwsyslog_enable 1

    4. In SmartConsole, install policy on this Security Gateway / Cluster object.

    1. Connect to the command line on the Security Gateway / each Cluster Member.

    2. Log in to the Expert mode.

    3. Edit the $FWDIR/boot/modules/fwkern.conf file:

      vi $FWDIR/boot/modules/fwkern.conf

    4. Add this line:

      fwsyslog_enable=1

    5. Save the changes in the file and exit the editor.

    6. Reboot the Security Gateway / each Cluster Member.

    1. Connect to the command line on the Security Gateway / each Cluster Member.

    2. Log in to the Expert mode.

    3. Run:

      fw ctl set int fwsyslog_enable 0

    1. Connect to the command line on the Security Gateway / each Cluster Member.

    2. Log in to the Expert mode.

    3. Edit the $FWDIR/boot/modules/fwkern.conf file:

      vi $FWDIR/boot/modules/fwkern.conf

    4. Do one of these actions:

      • Set the value of the kernel parameter to 0:

        fwsyslog_enable=0

      • Delete the entire line:

        fwsyslog_enable=1

    5. Save the changes in the file and exit the editor.

    6. Reboot the Security Gateway / each Cluster Member.

Log Count for CoreXL Firewall Instances

You can see the current number of syslog logs sent by CoreXLClosed Performance-enhancing technology for Security Gateways on multi-core processing platforms. Multiple Check Point Firewall instances are running in parallel on multiple CPU cores. Firewall Instances on the Security Gateway / each Cluster Member.

  1. Connect to the command line on the Security Gateway / each Cluster Member.

  2. Log in to the Expert mode.

  3. Run:

    fw -i <CoreXL Firewall Instance Number> ctl get fwsyslog_nlogs_counter

    Sample output:

    fwsyslog_nlogs_counter = 21

  1. Make two command line connections to the Security Gateway / each Cluster Member.

  2. In each command line connection, log in to the Expert mode.

  3. In the first shell, run:

    fw ctl zdebug | grep logs

  4. In the second shell, run:

    fw ctl set int fwsyslog_print_counter 1

  5. In the first shell, see the counter for each CoreXL Firewall instance and the sum of all CoreXL Firewall instances.

    Sample output:

    ;[cpu_2];[fw4_0];Number of logs sent from instance 0 is 43;

    ;[cpu_2];[fw4_0];Number of logs sent from instance 1 is 39;

    ;[cpu_2];[fw4_0];Number of logs sent from instance 2 is 50;

    ;[cpu_2];[fw4_0];Total logs sent from kernel (all instances) = 132;

  6. In the first shell, press CTRL+C to stop the debug.

For more on syslog, see: Appendix: Manual Syslog Parsing.