fw fetchlogs

Description

Fetches the specified Security log files ($FWDIR/log/*.log*) or Audit log files ($FWDIR/log/*.adtlog*) from the specified Check Point server.

Important - You can run this command in the Expert mode or in Gaia Clish (Gaia gClish on Scalable Platforms).

Syntax

fw [-d] fetchlogs [-f <Name of Log File 1>] [-f <Name of Log File 2>]... [-f <Name of Log File N>] <Target>

Parameters

Parameter

Description

-d

Runs the command in debug mode.

Use only if you troubleshoot the command itself.

Best Practice - If you use this parameter, then redirect the output to a file, or use the script command to save the entire CLI session.

-f <Name of Log File N>

Specifies the name of the log file to fetch. Need to specify name only.

Notes:

  • If you do not specify the log file name explicitly, the command transfers all Security log files ($FWDIR/log/*.log*) and all Audit log files ($FWDIR/log/*.adtlog*).

  • The specified log file name can include wildcards * and ? (for example, 2017-0?-*.log).

    If you enter a wildcard, you must enclose it in double quotes or single quotes.

  • You can specify multiple log files in one command.

    You must use the -f parameter for each log file name pattern.

  • This command also transfers the applicable log pointer files.

<Target>

Specifies the remote Check Point server, with which this local Check Point server has established SIC trust.

Notes:

  • The local and the remote servers must have established SIC trust.

  • The local server can be a Security Management Server, a Log Server, a Cluster Member.

  • The remote server can be a Security Gateway, a Cluster Member, a Log Server, or a Security Management Server in High Availability deployment.

  • You can specify the remote managed server by its main IP address or Object Name as configured in SmartConsole.

Notes:

  • This command moves the specified log files from the $FWDIR/log/ directory on the specified Check Point server.

    Meaning, it deletes the specified log files on the specified Check Point server after it copies them successfully.

  • This command moves the specified log files to the $FWDIR/log/ directory on the local Check Point server, on which you run this command.

  • This command cannot fetch the active log files $FWDIR/log/fw.log or $FWDIR/log/fw.adtlog.

    To fetch these active log files:

    1. Perform the log switch on the applicable Check Point server:

      See fw logswitch.

      fw logswitch [-audit] [-h <IP Address or Hostname>]

    2. Fetch the rotated log file from the applicable Check Point server:

      fw fetchlogs -f <Log File Name> <IP Address or Hostname>

  • This command renames the log files it fetched from the specified Check Point server.

    The new log file name is the concatenation of these:

    • The Check Point server's name (as configured in SmartConsole).

    • Two underscore (_) characters.

    • The original log file name

    Example: MyGW__2019-06-01_000000.log

Example - Fetching log files from a Management Server

[Expert@HostName:0]# fw lslogs MyGW
     Size Log file name
        23KB 2019-05-16_000000.log
         9KB 2019-05-17_000000.log
        11KB 2019-05-18_000000.log
      5796KB 2019-06-01_000000.log
      4610KB fw.log
[Expert@HostName:0]#
 
[Expert@HostName:0]# fw fetchlogs -f 2019-06-01_000000 MyGW
File fetching in process. It may take some time...
File MyGW__2019-06-01_000000.log was fetched successfully
[Expert@HostName:0]#
 
[Expert@HostName:0]# ls $FWDIR/log/MyGW*
/opt/CPsuite-R82/fw1/log/MyGW__2019-06-01_000000.log
/opt/CPsuite-R82/fw1/log/MyGW__2019-06-01_000000.logaccount_ptr
/opt/CPsuite-R82/fw1/log/MyGW__2019-06-01_000000.loginitial_ptr
/opt/CPsuite-R82/fw1/log/MyGW__2019-06-01_000000.logptr
[Expert@HostName:0]#
 
[Expert@HostName:0]# fw lslogs MyGW
     Size Log file name
        23KB 2019-05-16_000000.log
         9KB 2019-05-17_000000.log
        11KB 2019-05-18_000000.log
      4610KB fw.log
[Expert@HostName:0]#