Smart Reporter

Problem: Logfiles are not used when the LogServer files are rotated on the Management Server.

See SK98588

R77.10 Log Server stops forwarding logs to LEA clients: SmartEvent, SmartReporter, OPSEC clients

Solution ID: sk98588
Product: SmartEvent / Eventia Analyzer, SmartReporter / Eventia Reporter, Multi-Domain Management / Provider-1, Security Management
Version: R77.10
OS: Gaia, SecurePlatform 2.6, Windows, Linux
Platform / Model: All
Date Created: 12-Feb-2014
Last Modified: 28-Aug-2014

Symptoms

R77.10 Log Server stops forwarding logs to LEA clients:

New events are not coming to SmartEvent.
Logs are not processed by SmartReporter consolidation session.
Logs are not forwarded to 3rd-party OPSEC clients.
Other versions are not affected.

Cause

When switching the active log to new one (log switch), R77.10 Log Server does not notify the LEA client about the new log file.

Issue occurs on R77.10 Log Servers in the following environments:

Multi-Domain Security Management Server.
Smart-1 5 appliance.
Log Servers with deactivated ‘Spawn_LEA’ attribute (see sk91343).

Solution

This problem was fixed. The fix is included in Check Point R77.20

Leave a Reply

Your email address will not be published. Required fields are marked *