Getting Data In
Highlighted

Checkpoint LEA App working issue: all logs entries are downloaded at each script execution

Engager

Hello,

We are a consulting firm and I am assessing the Splunk solution for one of my customer.

The LEA application for Checkpoint is not working correctly : each time the script is called, it downloads the complete fw.log file. It results with a huge data indexing activity - and license expiration warnings!

I assume the script should normally download the difference since last LEA download.

Could somebody help to clarify how it works and what might going wrong with our installation?

Your help appreciated. Many thanks.

Laurent

Highlighted

Re: Checkpoint LEA App working issue: all logs entries are downloaded at each script execution

Super Champion

If you don't get an answer here, you should try contacting splunk support: Simply email support@splunk.com, or give them a call.

0 Karma
Highlighted

Re: Checkpoint LEA App working issue: all logs entries are downloaded at each script execution

Path Finder

Hey, LauMat, did you solve this problem? If not, double-check the permissions on your lea_loggrabber app(s) - the lea app stores its state in bin/ but whatever user this app is running as needs write permission to some of the files in this directory. In your case I believe that it is (or was) unable to write to lea_log_rec_num.cache which is where it keeps track of the last line read off the wire.

Highlighted

Re: Checkpoint LEA App working issue: all logs entries are downloaded at each script execution

Path Finder

(For debugging lealoggrabber issues it can be useful to execute the command with strace (plus the lealoggrabber --debug flag).

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.