topic Re: troubleshooting splunk-checkpoint communication in Installation

troubleshooting splunk-checkpoint communication

jonathanhowell — Thu, 17 Jun 2010 00:32:17 GMT

I am evaluating Splun 4.x as my log file analyzer for a Checkpoint UTM-1. I followed the procedures for configuring an LEA connector & setting up OPSEC. It appears that Splunk is running & making LEA requests of the Checkpoint, but I get no data logged on Splunk.

How can I best go about troubleshooting this? What log files or debug commands can i use to trace down the fault?

I appreciate your help. Jonathan

Re: troubleshooting splunk-checkpoint communication

Yancy — Thu, 17 Jun 2010 02:55:24 GMT

The splunkd.log at $SPLUNK_HOME/var/log/splunk/ is usually good for this sort of troubleshooting. If for some reason an input is being skipped, this will often be the place that it's logged.

Re: troubleshooting splunk-checkpoint communication

treyka — Tue, 07 Sep 2010 20:14:27 GMT

jonathanhowell -

Splunk's lea_loggrabber app is open-source. I have a patch which enables more verbose logging - quite useful for debugging lea_loggrabber issues. (It also includes a few other enhancements.) It's working very well for months now, not only in my environment but elsewhere. I've requested Splunk to either grant me commit access to their google code project for lea_loggrabber or at least to review my patch and make it available. Unfortunately no action on their side to date, other than opening the source. Send me a direct message with your email address and I'll send you a package with the patch, readme, plus some support scripts and useful lookups.

Cheers, --Trey

Re: troubleshooting splunk-checkpoint communication

jplaberge — Thu, 09 Sep 2010 01:11:00 GMT

Trey

We are experiencing the exact same behaviour than ‘Starlette’ in http://answers.splunk.com/questions/947/splunking-my-checkpoint-firewall-logs We are interested to your package with the patch. We are running on RedHat 5-64. How can we get it?

Thanks

Cheers, JP

Re: troubleshooting splunk-checkpoint communication

hexx — Thu, 09 Sep 2010 01:43:35 GMT

Hello Trey,
Thank you for taking the time to enhance this app and share that with other users.
I'll send you my email address to get a copy of your package. I will give it a go and try to give some traction to your request if it proves helpful in troubleshooting jplaberge's issue.

Re: troubleshooting splunk-checkpoint communication

csoh — Tue, 05 Apr 2011 09:47:19 GMT

Hi,

We are also interested in your package... possible to take a look?

Thanks

Cheers, Vincent