How to configure the Splunk Add-on for Check Point OPSEC LEA to prevent indexing delays?

[jakewalter]

Our Check Point firewall environment seems to be a little more verbose than what the Splunk add-on expects, resulting in 1 hour plus delays in logging. In version 3.x.x of the OPSEC LEA add-on, we used fw1-loggrabber.conf to set SPLUNK_REST_STATUS_COMMIT="100000", which allowed the logs to be indexed at near real-time. With version 4.x.x, these settings are no longer available. Is there an equivalent setting that could be tweaked in either a conf file, or directly within a python script?

[bheemireddi]

Check the documentation for the "mode" setting in the inputs.conf, in the past changing to "online" mode helped a bit.
Also check the no-resolve as this takes up the cycles, you don't want to resolve the objects.
https://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Setup2
It also depends on the number of checkpoint managers/connections you are handling on one forwarder. When it gets to millions of events from 50 different connections on forwarder can really get overloaded and you might need to look into distributing the load.
This is just one of the scenario I have seen, but the yours might be different.

[rodrigorsilva]

In the configurations there is a parameter (interval) as below:

 [input name]
 connection = connection name from opseclea_connection.conf
 data = Data to fetch: non_audit (Non-Audit), fw (Firewall Events), audit (Firewall Audit), smartdefense (SmartDefense), or vpn (VPN)
 index = index to use for the fetched data
 interval = input interval in seconds
 mode = input mode: offline or online
 disabled = 0 = enabled; 1 = disabled
 host = value to use for Host field in Splunk events (optional)
 starttime = start time to fetch data in format YYYY-MM-DDThh:mm:ssTZD (optional). Example: 2016-06-01T00:00:00+08:00
 noresolve = 0 = off; 1 = on. Loggrabber --no-resolve argument which prevents object name resolution

This is responsible for setting the collection interval, check the link:
http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Configureinputs

In the past I had a problem with delay in the events, it started in real time and after a certain time started, it continued to delay events, resolved after cpstop / cpstart in the manager.
I hope I have helped.

Rodrigo Ribeiro

[splunk47]

hi did you decrease or increase the interval to avoid delay of events and cpstop and start means resatarting the splunk server where checkpoint conf is present ?