Retrieving the Check Point Audit Log

By default, Check Point management servers (SmartCenters and Provider-1 CMAs) store audit logs that track administrative actions locally, rather than sending them to the Log Server or CLM. SecureTrack retrieves audit logs from the management server, not from the Log Server or CLM. If you configured your management server to send audit logs to the Log Server or CLM, you must configure SecureTrack to retrieve them from there.

To configure SecureTrack to retrieve audit logs from the Log Server or CLM:

1. Add to SecureTrack the first management server and its associated Log Server or CLM.
2. In the Device Configuration list, select the relevant management server (not the log server).
3. Click Edit configuration:

   

4. Click Next and Next.
5. In the stage 3 page, select Custom.
6. By Retrieve audit logs from, select the appropriate CLM/Log Server:

   

7. Click Next, and then Save.

How Do I Get Here?

In SecureTrack, go to Settings > Monitoring > Device Groups