Getting Log Files for Upload

You can upload log files from your device to an APG job so that you can analyze past traffic, but you must first prepare the log files so that they are in the correct format for analysis. For Check Point devices, you can also do this from the command line.

To prepare log files from firewall devices:

1. Collecting the log files from the firewall for the desired time frame.
2. Remove all logs not related to traffic.
3. Remove drop logs (unless you are analyzing dropped traffic).
4. Filter for other values, if necessary.
5. Identify and extract the relevant fields (source; destination; port; IP-protocol) in the logs.
6. Convert the field values to the standard format: source destination port IP-protocol

   For example:

   10.0.0.1 192.168.1.2 22 6

   32.1.33.2 192.168.1.2 53 17

7. Store the results in a single file.