Modify the Log_exporter Configuration

This procedure describes how to modify the configuration of the existing log-exporter instance for TLS.

Prerequisites

  • Ensure that the Check Point Log Exporter is installed on your management device.

  • Create the log_exporter with the cp_log_export add command, as described in the Check Point Support Center: SecureKnowledge Details > Log Exporter - Check Point Log Export (Solution ID sk122323).

  • It is assumed that certificate generation occurs on another machine. Before you configure the log_exporter, transfer the following files to the Check Point machine:

    • ca.pem

    • client.p12

    Configure the log_exporter

    1. Create the log_exporter with the cp_log_export add command, as described in the Check Point Support Center: SecureKnowledge Details > Log Exporter - Check Point Log Export (Solution ID sk122323)

      cp_log_export add name <Name> [domain-server {mds | all}] target-server <HostName or IP address of Target Server> target-port <Port on Target Server> protocol udp format {syslog}

    2. Run:

      3. cp_log_export set name <exporter-name> domain-server <domain-server> ca-cert <path_to_CA_pem> client-cert <path_to_p12_certificate> client-secret <challenge_phrase_for _p12>

    3. Restart the log_exporter instance with the command:

      cp_log_export restart name <exporter-name>

    4. Configure the log_id:

      edit <exporter-name>/conf/SyslogFormatDefinition.xml

    5. Perform the following change to the existing file:

      From:

      <!-- HOSTNAME-->    
        <header>
          <default_value>-</default_value>
          <assign_order>init</assign_order>
            <callback>
              <name>get_host_name_callback</name>
            </callback>
        </header>

      To:

      <!-- HOSTNAME-->
        <header>
          <default_value><Desired-Log-ID-Name></default_value>
        </header>

      Make note of the log ID you choose. You will need it to add a new monitored device to SecureTrack.

    6. Restart the log_exporter instance: 
      cp_log_export restart name <exporter-name>