Re: [FW-1] Logging sperately ,managing centrally

[Jason Stout <jasonstout@FW1-NOSPAMRINGZEROSECURITY.COM>]

Dave,

I'm relatively certain that CLM is for Provider-1 only. If I recall correctly, CLM is simply another Provider-1 Management server devoted to logging. This unburdens the primary management server of logging operations which can be quite drastic on a large Provider-1 deployment.

My only advice would be to load up the management server with as much memory as possible and then use excessive use of filters to narrow down your logging searches. You can seperate logs per firewall easily but to do so (AFAIK)requires you to logswitch and logexport which doesn't help when you want to use the log viewer for troubleshooting.

I suppose you could also write a user defined script which would log to a SQL server and do your searches that way. Probably a lot more involved then you would want to get though.

Regards,
Jason Stout

On Sun, 16 December 2001, Dave Survey wrote:

>
> Hi
>
> We have 4 checkpoint firewalls -2 internet gateway and 2 with enterprise
> management consoles.We want to consolidate and plan to use one management
> console to control all 4.
>
> I beliefs the logs coming in will all become one BIG file ?
> even now the logs can be huge from one firewall and sometimes we get real
> slow response (especially frustrating when troubleshooting).
>
> How can we acheieve central control but have the logging "seperated "such
> that when we troubleshoot we look at the particular fw logs only ?
> i know it sounds cobflicting-hope i am putting it clearly :)
> Selecting different origin in log viewer is not an answer as speed is BAd.
>
> should we look at CLm-customer log module ? is this something only for
> Provider 1- ?? no one seems to know much about it.
>
>
> TIA for all advice
>
>
>
>
>
> _________________________________________________________________
> MSN Photos is the easiest way to share and print your photos:
> http://photos.msn.com/support/worldwide.aspx
>
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> To set vacation, Out Of Office, or away messages,
> send an email to LISTSERV@lists.us.checkpoint.com
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> If you have any questions on how to change your
> subscription options, email Ron Alcatraz at:
> ralcatra@ts.checkpoint.com
> =================================================

=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
If you have any questions on how to change your
subscription options, email Ron Alcatraz at:
ralcatra@ts.checkpoint.com
=================================================