topic Re: Options in lea-loggrabber app in Getting Data In

Options in lea-loggrabber app

Mahieu — Mon, 22 Sep 2014 09:02:02 GMT

Hi there,

I'm using the old lea-loggrabber app for collecting my Checkpoint logs (this one http://wiki.splunk.com/Community:Configure_OPSEC_LEA_input).
Is there a way to disable name resolution in there ?
I've seen that it's a simple option in the new Splunk Add-on for Check Point OPSEC LEA.

I might migrate to the new app but I need to work on it as I've made a few changes to my scripts to support Splunk HA.
I have two indexers in a cluster and I can't have both running the script which would mean indexing the logs twice.

Thanks in advance.

Re: Options in lea-loggrabber app

duberich — Mon, 22 Sep 2014 13:11:48 GMT

You can turn off name resolution with a patched binary as referenced in http://answers.splunk.com/answers/23975/check-point-object-name-resolution.html

We usually setup a separate heavy forwarder for data collection using a pull for things like checkpoint, mcafee, sourcefire, dbcollect, etc.

Regards,
--RIch

Re: Options in lea-loggrabber app

Mahieu — Mon, 22 Sep 2014 14:07:55 GMT

Looks interesting, do you know where I can get this patched version ?
Thanks in advance.

Mat

Re: Options in lea-loggrabber app

duberich — Mon, 22 Sep 2014 14:24:06 GMT

Should be able to get it through support.

--Rich