Check Point L-71, Руководство администратора

Страница: 108 / 124

Appliance Configuration
Check Point 1400 Appliances Centrally Managed Administration Guide R77.20.85 | 108
Logs and Monitoring
This section describes the security and system logs. It also describes various monitoring tools.
Viewing Security Logs
The
Logs & Monitoring
>
Logs
>
Security Logs
page shows the last 100 log records.
To load more records, continue scrolling down the page. The log table is automatically refreshed.
To search for a security log:
Enter your query in the
Enter search query
box. You can only search one field at a time (AND/OR
operators are not supported).
Use this syntax:
<IP_address>
or
<column_name>
:
<value>
For example:
203.0.113.64
or
action:drop
or
source port:22
For more details, click Query Syntax in the table header.
To see the security log record:
1. Select a log entry from the list.
2. Click
View Details
or double-click the entry.
The log record opens.
To refresh the security log data:
Click the refresh icon .
To stop local logging:
When necessary, you can stop local logging for better performance. This removes the overhead of
creating and maintaining logs. No new logs are generated until you set the resume option.
1.
Select
Options
>
Stop local logging
.
2. To resume, select
Options
>
Resume local logging
.
Storing Logs
Logs can be stored locally on the appliance's non-persistent memory or on an external SD card
(persistent). Logs can also be sent to an externally managed log server (see
Log Servers
page).
When you insert an SD card, it mounts automatically and then local logs are saved to it. Before you
eject an SD card, make sure to unmount it. Select
Options > Eject SD card safely .