Configuring External Log Servers; External Check Point Log Server - Check Point QUANTUM SPARK 1500 Administration Manual

Configuring External Log Servers

The Logs & Monitoring
logs for additional logging storage.
Note - You cannot configure external log servers when Cloud Services is turned on.

External Check Point Log Server

You can use an external Check Point Log Server that is managed by a Security Management Server for
storing additional logs.
Use cases for an external Check Point Log Server:
n Extend the log retention time. For example, currently, when your gateway is managed by Quantum
Spark Portal, you can retain logs for 3 months. If you configure an external Log Server, you can retain
the logs for a year.
Export the logs format to a 3rd party mechanism for data mining.
n
Do these steps before you configure an external Check Point Log Server from this page in the WebUI:
1. Identify the Log Server you want to send logs to.
2. Identify the Security Management Server that manages the Log Server.
3. Open SmartConsole on this Security Management Server.
4. Run the Security Gateway wizard to define and create a Security Gateway object that represents this
appliance with the these details:
In the General Properties
n Gateway platform
Gateway IP address
n
In the Trusted Communication
connect.
5. Install the database on the Security Management Server and other related objects.
To configure an external Check Point Log Server:
1. Under Check Point Log
The External Check Point Log Server window opens.
2. Enter the Management Server IP
This IP address is used only to establish trusted communication between the appliance and the
Security Management Server.
3. In SIC name, enter the SIC name of the Log Server object defined in SmartConsole.
These are the options to get this name:
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide | 301
> Log Servers page lets you configure external log servers for security and system
window, select:
- Select your appliance
- Dynamic IP address
window, from
Server, click Configure.
address.
Configuring External Log Servers
Gateway Identifier select MAC address or First to