Watch Video - https://youtu.be/fZEy-fmjjpE
Viewing Log Files
Filters
SmartView Tracker's filtering mechanism allows you to conveniently
focus on log data of interest and hide other data, by defining the appropriate
criteria per-log field. Once you have applied the filtering criteria, only
entries matching the selected criteria are displayed.
The filtering options available are a function of the log field in
question. For example, while the Date field is filtered to show data that is after, before or in
the range of the specified date, the Source, Destination and Origin fields are filtered to match (or differ from) the
specified machines.
It is very useful to filter the Product field and focus on a specific
Check Point product. SmartView Tracker features these filters as predefined queries.
Queries
SmartView Tracker gives you control over the Log file information
displayed. You can either display all records in the
Log file, or filter the display to focus on a
limited set of records matching one or more conditions you are interested in.
This filtering is achieved by running a query.
A query consists of the following components:
o
Condition(s) applied to one or more log fields (record columns) —
for example, to investigate all HTTP requests arriving from a specific source,
you can run a query specifying HTTP as the Service column's filter
and the machine in question as the Source column's filter.
o
A selection of the columns you wish to show — for example, when
investigating HTTP requests it is relevant to show the URL log field.
Each of the SmartDashboard modes (Log, Active and Audit) has its own Query Tree, with these folders:
o
Predefined: contains the default queries that cannot be
directly modified or saved.
The predefined queries
available depend on the mode you are in. The default query of all three modes
is All Records. In addition, the Log mode includes predefined per
product or feature.
o
Custom: allows you to customize your own Query based
on a predefined one, to better address your needs. Customized queries are the
main querying tool, allowing you to pinpoint the data you are interested in. An
existing query that is copied or saved under a new name is automatically added
to the Custom folder.
The attributes of the selected query are displayed in the Query Properties pane.
Matching
Rules
SmartView Tracker records the Firewall Rule Base rule to which a
connection was matched. The matching rule is recorded in four columns in
SmartView Tracker, as depicted in the figure below:
o
The Rule column, which records the number of the
rule in the Rule Base at the time the log entry was recorded. Like other
properties in SmartView Tracker, logs can be sorted and queried by rule number.
o
The Current Rule Number column, which is a
dynamic field that reflects the current placement of the rule in the Rule Base
and displays the current policy package name. As the Rule Base is typically
subject to change, this column makes it possible to locate the rules that have
changed their relative positions in the Rule Base since the log was recorded,
and to create filters for log entries that match the rule, not just the rule
number. By way of example, note the log entry in the figure. When this log was
first recorded, it recorded the matching rule as Rule 1.
Since then the rule's position in the Rule Base has changed, and so the Current Rule Number column reports
its present position as 2 [Standard], where [Standard] is
the name of the policy package in which this rule resides.
o
The Rule Name column, which records the short textual
description of the rule in the Namecolumn of the Rule
Base, when in use.
o
The Rule UID column, which records the unique identifying
number (UID) that is generated for each rule at the time that it is created.
This number serves an internal tracking function, and as such the column is
hidden by default. To display this column, click on View > Query
Properties and enable the Rule UID property.
Filtering Log Entries by Matching Rule
In order to filter log entries based on a matching rule,
right-click on a log entry and choose either Follow Rule or Follow Rule Number.
o
Follow Rule generates a filtered view of all logs
that matched this rule, and is based on the UID number of the rule.
o
Follow Rule Number generates a filtered view of all
log files that match the number recorded in the Rule column of the
selected log.
These two operations are essentially short-cuts to creating a
filter. You can achieve the same results by right-clicking anywhere in a given
column and selecting Edit Filter, and then entering the filtering criteria you want to apply.
The Rule and Current Rule Number filters, which provide the same functionality as the Follow Ruleand Follow Rule Number commands, can also create filtered
views based on multiple matching rules. The figure below shows the Current Rule Number Filter.
Viewing the Matching Rule in Context
From SmartView Tracker, you can launch SmartDashboard to examine
the rule within the context of the Firewall Rule Base. By right-clicking on the
relevant log and selecting View rule in SmartDashboard, SmartDashboard will open with the rule highlighted in
white.
If you are using version control, SmartDashboard opens with the
revision that was saved when this record was created. If no revision is
available, SmartDashboard uses the unique identifying number to display the
relevant rule. If neither version control nor a UID number are available, the View rule in SmartDashboard option is not available.
Viewing the Logs of a Rule from SmartDashboard
From the firewall Rule Base in SmartDashboard, there are two
methods by which you can launch SmartView Tracker to view all of the log
entries that matched on a particular rule. By right-clicking on the rule, you
can choose to either:
o
View rule logs in SmartView Tracker, which opens
SmartView Tracker to a filtered view of all logs that matched on the rule.
o
Copy Rule ID, which copies the unique identifying number
of the rule to the clipboard, allowing the user to paste the value into the Rule UID Filter in SmartView
Tracker.
Maintaining Log
Files with Log Switch
The active Log file's size is kept below the 2 GB default limit by
closing the current file when it approaches this limit and starting a new file.
This operation, known as a log switch, is performed either automatically, when
the Log file reaches the specified size or according to a log switch schedule;
or manually, from SmartView Tracker.
The file that is closed is written to the disk and named according
to the current date and time. The new Log file automatically receives the
default Log file name (
$FWDIR/log/fw.log for log modeand $FWDIR/log/fw.adtlog for audit mode).
Managing Disk
Space with Cyclic Logging
When there is a lack of sufficient free disk space, the system
stops generating logs. To ensure the logging process continues even when there
is not enough disk space, you can set a process known as Cyclic Logging. This
process automatically starts deleting old log files when the specified free
disk space limit is reached, so that the Security Gateway can continue logging
new information. The Cyclic Logging process is controlled by:
o
Modifying the amount of required free disk space.
o
Setting the Security Gateway to refrain from deleting logs from a
specific number of days back.
Exporting Logs
While SmartView Tracker is the standard log tracking solution, you
may also wish to use your logs in other ways that are specific to your
organization. For that purpose, Check Point products provide you with the
option to export log files to the appropriate destination.
A log file can be exported in two different ways:
o
As a simple text file
o
In a database format, exported to an external Oracle database
SmartView Tracker supports a basic export operation, in which the display is
copied as-is into a text file. More advanced export operations (for example,
exporting the whole log file or exporting logs online)
are performed using the command line (using the
fwm
logexport, log_export and fw log commands).
With the Export option
(File >
Export) you can
create a comma delimited ASCII file that can be used as input for other
applications.
Saving Logs on
Security Gateways
By default, Security Gateways forward their log records online to
the Security Management server. Alternatively, to improve the gateway's
performance, you can free it from constantly sending logs by saving the
information to local log files. These files can either be automatically
forwarded to the Security Management server or Log Server, according to a
specified schedule; or manually imported through SmartView Tracker, using the Remote File Management operation.
Logging
Behavior during Downtime
During downtime, when the gateway cannot forward its logs, they
are written to a local file. To view these local files, you must manually
import them using the Remote File Managementoperation.
Logging
Using Log Servers
To reduce the load on the Security Management server,
administrators can install Log Servers and then configure the gateways to
forward their logs to these Log Servers. In this case, the logs are viewed by
logging with SmartView Tracker into the Log Server machine (instead of the
Security Management server machine).
A Log Server behaves just like a Security Management server for
all log management purposes: it executes the operation specified in the Policy
for events matching certain rules (e.g., issuing an alert or an email);
performs an Automatic Log Switch when
fw.log reaches 2GB, allows you to export
files, etc.
Setting Up
Security Management Server for Log Server
Logs are not automatically forwarded to new log servers. You must
manually setup each relevant gateway to send its logs to the new log server.
The same plug-ins should be installed on all Security Management servers and
log servers involved in order for the install policy procedure to be
successful.
To instruct a Security Management
server to send logs to a Log server:
1.
In SmartDashboard, double-click the gateway object to display its Check Point
Gateway window.
2.
Select Logs and Masters > Additional Logging. Select Forward log files
to Log Server.
The Security Management
server drop-down list is enabled.
3.
Select the new log server from the Security Managements drop-down
list and click OK.
4.
Select Policy > Install, and then select the gateways and log
servers on which the Policy should be installed.
Maintaining a
Secure Network
Using
Check Point Advisories
Check Point Advisory are detailed descriptions and step-by-step
instructions on how to activate and configure relevant defenses provided by
Check Point and IPS Updates.
The ability to view a Check Point Advisory in SmartView Tracker
provides information about the IPS protection that is directly related to the
selected IPS log. This information can help you analyze your configuration
choices and better understand why the specific SmartView Tracker log appeared.
In addition, Check Point Advisory supplies all of your IPS
configuration choices so that you can learn why the specific log appeared. To
view Check Point Advisory for a specific IPS log, right-click the log and
select Go to
Advisory.
For more detailed information about the IPS log and associated
protection, scroll down to the bottom of the Check Point Advisory window and
select Read the
Full ADVISORY and SOLUTION.
The Check Point Advisory feature will not appear for logs that do
not contain an Attack Name and/or Attack Information.
Blocking
Intruders
The Active mode
of SmartView Tracker allows you to shut out intruders by selecting the
connection you've identified as intrusive and blocking one of the following. Block Intruder uses SAM to perform the block
action.
o
The connection - block the selected connection or any other
connection with the same service, source or destination.
o
The source of the connection - block access to and from this
source. Block all connections that are headed to or coming from the machine
specified in the Source field.
o
The destination of the connection - block access to and from this
destination. Block all connections that are headed to or coming from the
machine specified in the Destinationfield.
o
Specify a time frame during which this connection is to be
blocked.
Running Custom
Commands
SmartView Tracker allows you to conveniently run commands from the
SmartConsole, instead of working in the command line. The commands available by
default are
ping and whois. These commands, along with the ones
you add manually, are available through the menu displayed by right-clicking a
relevant cell in the Records pane.
Viewing Packet
Capture
Certain Check Point products include the ability to capture
network traffic. After this feature is activated, a packet capture file is sent
with a log to the log server. The packet capture can be retrieved at a later
time to allow the administrator greater insight into the exact traffic which
generated the alert.
The packet capture file can be accessed from the log entry in
SmartView Tracker. The file can be saved as a file to a file location, or can
be opened in the internal viewer included in the SmartConsole or any packet
capture viewer installed on the SmartConsole client.
No comments:
Post a Comment