Configuring External Log Servers

The Logs & Monitoring > Log Servers page lets you configure external log servers for security and system logs for additional logging storage.

To configure an external syslog server:

  1. Under Syslog Servers, click Configure.

    The External Syslog Server window opens.

  2. Select Protocol:

    • TLS Over TCP (secured) - Send system logs from gateways in a secured and encrypted fashion.

    • UDP - Send security logs or system logs (not secured).

  3. Enter a Name and IP address.

  4. Enter a Port number.

  5. Select Enable log server.

  6. Optional - Select Show Obfuscated Fields. Obfuscated packets are shown as plain text.

  7. Select logs to forward:

    • System logs

    • Security logs

    • Both system and security logs

    Note - When you select TLS Over TCP, you can only forward system logs. Security logs are not supported.

  8. Click Apply.

Secured Syslog

Use Case

A system administrator wants to send system logs from the organization's gateways in a secured and encrypted fashion. Therefore, he selects TLS Over TCP as the protocol. UDP is not secure.

Notes:

  • Only one remote TLS server is supported.

  • The server CA must be trusted by Check Point.

  • The TLS server must be configured using its domain name. Only UDP allows you to configure the server by IP address.

  • The configured domain name must be identical to the domain name in the server's certificate.

  • Only system logs are supported.

To configure additional syslog servers:

Click Add Syslog Server.

To send security logs to syslog servers:

When you configure the log server, for Protocol select UDP.

Note - The security logs show in the syslog format, not in the security logs format.

To edit the external syslog server:

  1. Click the Edit link next to the server's IP address.

  2. Edit the necessary information.

  3. Click Apply.

Note - When more than one server is defined, the syslog servers show in a table. Select the syslog server you want to edit and click Edit.

To delete the external syslog server:

  1. Select the syslog server.

  2. Click Delete.

    The server is deleted.