Splunk Add-on for Check Point OPSEC LEA: What is the configuration for 4.xx version and other ways to avoid events delay?

[splunk47]

In version 3.x.x of the Splunk Add-on for Check Point OPSEC LEA, we used fw1-loggrabber.conf to set SPLUNK_REST_STATUS_COMMIT="100000". What is the configuration for 4.xx version and other ways to avoid events delay?

Please respond

[splunk47]

we will be moving with new app in next week .. so offline is the default mode only?
and by default interval is 30 sec .. so by increasing the time to 60 how it is going to help ?
we should decrease the time so that we should be updated with events regularly

[gjanders]

In the older versions the default was 3600 seconds (an hour), offline mode means that the process will exit once it reads the logs of the firewall.

I have found it takes 10-20 seconds before the process exits in offline mode, there were some known issues in online mode in the old versions (from what I have heard) so I've avoided using that mode, I have not re-tested in this new version.
I've also read online the no-resolve button can change how this works.

30 seconds might work in your environment if you are happy with the process regularly re-spawning itself to read logs (I found 60 seconds often enough).

The only thing I noted during the upgrade to the new version is that the checkpoint (where we got to in reading the firewall logs) changed location and therefore there was some initial duplication that occurred.

This is a Splunk supported application so you could always log a ticket with Splunk to discuss this, but I suspect you could just run the new application and see how it goes...

[splunk47]

interval conf of 3600 is in inputs.conf or fw1-loggrabber.conf ?

i have changed the inputs.conf for each connection to 30 sec to get the data

[gjanders]

opseclea_inputs.conf

[gjanders]

I have managed to set no customer parameters on the 4.2.0 version of the Splunk Add-on for Check Point OPSEC LEA and can pull in approx 80GB/day of data.
I'm using offline mode and the interval of 60 seconds to ensure we stay up-to-date with the firewall logs.

The 80GB/day is an example of one of the inputs, the heavy forwarder running the app does not do a lot of activity beyond these logs (it's not completely dedicated but this is one of the heavy sources on the server)

Have you tested the new version of the OpsSec app?