7.5 Logs, Monitor, and SmartEvent

Logs, Monitor, and SmartEvent

Check Point gateways generate logs for every connection, drop, threat, and VPN event. Those logs flow from the gateway to a Log Server (often the Security Management Server itself in small deployments) and from there are viewed in SmartConsole Logs, the SmartView web application, and correlated into events by SmartEvent. CCSA candidates must know the architecture, the log tracking options on a rule, the query language basics, what log indexing does, and what SmartEvent adds on top of raw logs.

Log Flow Architecture

Security Gateway -> Log Server -> SmartEvent Correlation Unit -> SmartEvent Server -> SmartConsole / SmartView

The gateway sends logs to the Log Server over CPD/SSL (which is SIC-protected). The SmartEvent Correlation Unit analyzes incoming log streams against the Event Policy and raises security events when thresholds are crossed. The SmartEvent Server indexes logs for SmartView, holds the events database, and serves event views to clients. SmartView (https://<IP>/smartview/, case-sensitive, Chrome/Firefox only) gives the same real-time views as SmartConsole through a browser and can export up to 1,000,000 logs.

Log Tracking Options on a Rule

Each Access Control rule has a Track column. The options the CCSA exam expects you to know:

Log Generation Mode can be set to Per Connection or Per Session — important when you have long-lived sessions like a database connection that you do not want logged as a single giant record.

Query Language

SmartConsole Logs and SmartView support a query language with Boolean operators (AND, OR, NOT), wildcards (* and ?), and field keywords. Common fields include severity, action, blade, source / src, destination / dst, origin, service, user, and rule. For example, blade:"IPS" AND action:"Drop" shows only IPS drops. Queries are saved per user and can be shared. Queries against indexed Log Servers return almost instantly; against non-indexed servers they require a sequential scan of the log files, which is dramatically slower.

Log Indexing

Log indexing reduces query response time and is enabled by default on capable servers. It is disabled by default on Smart-1 205/210 and on open servers with fewer than 4 cores. When disabled, queries take longer and you must connect to each Log Server separately. Toggled in SmartConsole → Server object → Logs → Enable Log Indexing. The indexer uses Solr; if SmartView queries are slow on a server that should be indexed, the Solr process is the first thing to check.

SmartEvent Policy

The SmartEvent GUI client has its own Policy tab where you define Event Definitions. Each definition has configurable Thresholds, Severity (Informational / Low / Medium / High / Critical), Automatic Reactions, Exceptions, and Working Hours. Incoming logs are matched first against Global Exclusions, then against Event Definitions; when a definition's threshold is crossed, an event is created. Reactions can include email, SNMP trap, executing a script, blocking the source, or showing an alert in SmartConsole.

Event Examples and Architecture Notes

A typical event definition might be: "more than 50 drops from the same source in 10 minutes, severity High, reaction block source and email SOC." SmartEvent ships with dozens of prebuilt definitions for malware outbreaks, brute-force login, VPN anomalies, and policy changes — review and tune them rather than starting from zero. The Correlation Unit is a separate process that can run on the SmartEvent Server or on its own appliance in high-volume deployments; in very large environments you can scale out by adding Correlation Units. Note that SmartEvent and the Log Server are different products — the Log Server stores raw logs, SmartEvent indexes them and correlates them into events.

Log Modes and SmartLog

R82 also exposes SmartLog, the fast search client that depends on log indexing. With indexing enabled, SmartLog returns results from billions of logs in seconds. Without it, SmartLog falls back to sequential file scanning and queries can take minutes. Accounting log mode updates every 10 minutes with byte counters — useful for capacity reporting on long-lived connections, but not for security analysis. Detailed Log vs Log matters mostly for App Control and URL Filtering, where the extra fields are the entire point of the log. The Log Generation Mode (Per Connection vs Per Session) lets you choose between per-connection granularity and per-session consolidation for connection-oriented protocols.

Retention and Storage

• Daily logs retention configured in SmartConsole → Gateways & Servers → Server object → Logs → Storage.
• Maximum total retention: 3,664 days (indexed logs + log files combined).
• The Log Server deletes old logs daily at midnight.
• Disk management uses two thresholds: an alert level and a deletion level; once the deletion level is reached the oldest logs are removed automatically. The Management Server never deletes audit log files.

Exam Traps

• SmartView URL is case-sensitive (/smartview/, not /SmartView/) and supports only Chrome and Firefox.
• Detailed Log / Extended Log is the right Track setting for App Control and URL Filtering — plain Log does not capture the application/URL fields.
• If logs are missing in SmartView, the first thing to check is log indexing state and whether the gateway can reach the Log Server (SIC again).
• SmartEvent is a separate server from the Management Server in larger deployments; you can run it on the same box in small ones, but the components are distinct.
• Accounting updates every 10 minutes — not in real time, and not per-packet.