https://community.splunk.com/t5/Security/How-can-I-debug-my-lea-client-for-checkpoint/m-p/106573#M3407 <P>Does anyone know of a good way to debug problems with the checkpoint lea client? I've been having trouble getting my configured. </P> Tue, 08 Nov 2011 17:57:53 GMT jbsplunk 2011-11-08T17:57:53Z https://community.splunk.com/t5/Security/How-can-I-debug-my-lea-client-for-checkpoint/m-p/106573#M3407 <P>Does anyone know of a good way to debug problems with the checkpoint lea client? I've been having trouble getting my configured. </P> Tue, 08 Nov 2011 17:57:53 GMT https://community.splunk.com/t5/Security/How-can-I-debug-my-lea-client-for-checkpoint/m-p/106573#M3407 jbsplunk 2011-11-08T17:57:53Z https://community.splunk.com/t5/Security/How-can-I-debug-my-lea-client-for-checkpoint/m-p/106574#M3408 <P>Yes! you'll want to add a shell variable that calls OPSEC debugging when the lea_loggrabber client is called. <BR /> First, set the OPSEC debug level:</P> <PRE><CODE>OPSEC_DEBUG_LEVEL=3; export OPSEC_DEBUG_LEVEL </CODE></PRE> <P>Then run the splunk lea_loggrabber.sh script manually:</P> <PRE><CODE>SPLUNK_HOME=/opt/splunk/ ./lea-loggrabber.sh </CODE></PRE> <P>The debug output is very verbose so you may want to send the output to a file for splunk support to review. </P> <P>If you need to dive deeper into the problem, on the Checkpoint Manager you can also enable OPSEC debugging.</P> <PRE><CODE>% fw debug fwm on OPSEC_DEBUG_LEVEL=9 </CODE></PRE> <P>The debug file is located at $FWDIR/log/fwm.elg</P> <P>To stop the FWM debug, execute:</P> <PRE><CODE>% fw debug fwm off OPSEC_DEBUG_LEVEL=1 </CODE></PRE> Tue, 08 Nov 2011 18:21:50 GMT https://community.splunk.com/t5/Security/How-can-I-debug-my-lea-client-for-checkpoint/m-p/106574#M3408 Chubbybunny 2011-11-08T18:21:50Z