Checkpoint LEA App working issue: all logs entries are downloaded at each script execution

[LauMat]

Hello,

We are a consulting firm and I am assessing the Splunk solution for one of my customer.

The LEA application for Checkpoint is not working correctly : each time the script is called, it downloads the complete fw.log file. It results with a huge data indexing activity - and license expiration warnings!

I assume the script should normally download the difference since last LEA download.

Could somebody help to clarify how it works and what might going wrong with our installation?

Your help appreciated. Many thanks.

Laurent

[treyka]

Hey, LauMat, did you solve this problem? If not, double-check the permissions on your lea_loggrabber app(s) - the lea app stores its state in bin/ but whatever user this app is running as needs write permission to some of the files in this directory. In your case I believe that it is (or was) unable to write to lea_log_rec_num.cache which is where it keeps track of the last line read off the wire.

[treyka]

(For debugging lea_loggrabber issues it can be useful to execute the command with strace (plus the lea_loggrabber --debug flag).

[Lowell]

If you don't get an answer here, you should try contacting splunk support: Simply email support@splunk.com, or give them a call.