topic Re: Error regarding Checkpoint OPSEC LEA in Splunk Enterprise Security

Error regarding Checkpoint OPSEC LEA

kartreddy4 — Wed, 17 Oct 2018 19:54:29 GMT

I have installed the splunk Add-on on the Heavyforwarders and when trying to establishing the connection over TCP 18184 and hitting on save, its throwing up this error

External handler failed with code '1' and output: 'REST ERROR[400]: Bad Request - GNU C library (glibc.i686 32-bit and pam.i686) is missing.'. See splunkd.log for stderr output.

Do i need to install the 32bit lib files as requirement ?
Is configuring add-on, on the heavyfowarders the recommended way?
The checkpoint servers in my company are very outdated currently running major version R70 but the minimum requirement in splunk is R76 ? will it still work when configured. Please help

Re: Error regarding Checkpoint OPSEC LEA

gjanders — Wed, 17 Oct 2018 21:48:54 GMT

(1) Yes, or at least in the older versions you did
(2) Yes
(3) No idea, you might have to test it and see but I suspect Splunk support would be "best effort" if your using an incompatible version of the firewall logging server!

Re: Error regarding Checkpoint OPSEC LEA

jchapell — Wed, 17 Oct 2018 22:41:07 GMT

@gjanders is right, you will need the libraries installed, configuring on the heavy forwarder is the desired method, and as for working with r70, if you can find an older version of the app, it may work. I would personally look into upgrading my checkpoint instances to r80.10. I just moved ours from r77.30 to r80.10 and couldn't be happier with them after working out some kinks.