topic Re: Checkpoint LEA App working issue: all logs entries are downloaded at each script execution in Getting Data In

Checkpoint LEA App working issue: all logs entries are downloaded at each script execution

LauMat — Tue, 01 Jun 2010 23:50:13 GMT

Hello,

We are a consulting firm and I am assessing the Splunk solution for one of my customer.

The LEA application for Checkpoint is not working correctly : each time the script is called, it downloads the complete fw.log file. It results with a huge data indexing activity - and license expiration warnings!

I assume the script should normally download the difference since last LEA download.

Could somebody help to clarify how it works and what might going wrong with our installation?

Your help appreciated. Many thanks.

Laurent

Re: Checkpoint LEA App working issue: all logs entries are downloaded at each script execution

Lowell — Thu, 03 Jun 2010 01:09:13 GMT

If you don't get an answer here, you should try contacting splunk support: Simply email support@splunk.com, or give them a call.

Re: Checkpoint LEA App working issue: all logs entries are downloaded at each script execution

treyka — Tue, 07 Sep 2010 20:05:00 GMT

Hey, LauMat, did you solve this problem? If not, double-check the permissions on your lea_loggrabber app(s) - the lea app stores its state in bin/ but whatever user this app is running as needs write permission to some of the files in this directory. In your case I believe that it is (or was) unable to write to lea_log_rec_num.cache which is where it keeps track of the last line read off the wire.

Re: Checkpoint LEA App working issue: all logs entries are downloaded at each script execution

treyka — Mon, 28 Sep 2020 09:17:23 GMT

(For debugging lea_loggrabber issues it can be useful to execute the command with strace (plus the lea_loggrabber --debug flag).