Configuring Check Point Syslogs

This section contains the following topics:

For general information about sending syslogs, see Sending Additional Information using Syslog.

Check Point-Specific Syslog Notes

• By default, Check Point management servers (SmartCenters and Provider-1 CMAs) store audit logs that track administrative actions locally, rather than sending them to the Log Server or CLM. In this case, SecureTrack retrieves logs from the management server, not the Log Server or CLM. However, if you configured your management server to send traffic logs to the Log Server or CLM, you must also configure SecureTrack to retrieve logs from there.

• You must configure the log exporter on your CMA/SMC device. If you have a CLM log server, configure the log exporter on that as well to include traffic logs.

• You can receive Check Point Syslogs over UDP or Encrypted TCP.