Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Specifically, we're using fwm logexport piped to logger to dump the audit logs in real time via syslog to our SEIM. It works great if the command is run manually (in the background) from the "expert" command line, but then we have to remember to go back in and re-start it after a reboot.

The "Job Scheduler" allows for running a job at startup time, but it doesn't allow you to enter multiple commands connected with a pipe, and it turns out that its "@startup" happens too early in the boot process for this use (before all the CP processes have started).

Gaia tends to overwrite settings that are made outside of the configuration tools, but I don't know how extensive that is, so I'm hoping there's an official place for custom scripts that won't get purged.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

You should check article sk87560 from Check Point, it explains a supported way how to syslog to external server. Here is a shortened explanation.

Gaia OS logs to syslog server:

HostName> add syslog log-remote-address <IP_Address> level info
HostName> show syslog all
HostName> save config

Check Point firewall logs to syslog server: (in expert mode)

[Expert@HostName]# vi /etc/rc.d/init.d/cpboot

add row to the end

 fw log -f -t -n -l  2> /dev/null | awk 'NF' | logger -p local4.info -t CP_FireWall &

So in that sense /etc/rc.d/init.d/cpboot should work for your purposes, remember to add & to the end or you might get problems with the booting process.

share|improve this answer
    
That looks like it will solve my problem. Thanks! (I'll test before accepting the answer, just to keep things clean here.) –  Rob Walsh Nov 6 '13 at 20:19
    
OK, this answer solves my root problem, but is not really relevant to the question as I asked it. Should I fix the question so that this is an appropriate answer? Note that I've discovered that Job Scheduler is just cron, and @startup happens too early (pre-cpboot) to be helpful for starting the log exporting process. –  Rob Walsh Nov 7 '13 at 18:35
    
Fixed the question. A couple of notes: I think my predecessor may have actually submitted "sk87560" to be answered; I apologize for not checking for it. Also, while this method survives reboots, I suspect that it might not reliably survive an upgrade or patch (i.e., if cpboot gets updated). –  Rob Walsh Nov 8 '13 at 18:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.