Getting Data In

How to deploy Check Point OPSEC LEA on several heavy fowarder servers?

Path Finder


I have a couple of heavy forwaders running but only one with Checkpoint LEA 3.1 TA installed.
Thus in case of failover I'll loose all log grabbing from my Checkpoint CMA's.
But if I install the TA on each heavy forwarder with the same config I'll have multiple checkpoint logs entries.

How can setup a resilient installation of the opsec-lea TA accross mutliple forwarders?
Note: I plan to updgrade to v4.1 but I don't see any difference in the log collecting process.

0 Karma



Short answer based on my experience with OPSEC LEA 3.1: it's evil.

Even if you have the TA deployed on each HF with the same config, how do you sync them all so that they all know where to start to read from and you don't end up with duplicates or gaps?

Your best bet as far as I can tell would be to use Virtual Machines for that heavy forwarder and rely on whichever resiliency your VM team can provide: VM snapshots, backups, etc. Keep in mind your logs are stored in your CheckPoint CMAs for quite some time (depending on your configuration) so if a VM is unavailable for 1-2 hours it shouldn't be a massive disaster.

I don't know if v4.1 solves this problem as I'm not planning to upgrade any time soon.

Sorry it's probably not the answer you were looking. Maybe others can share their own experiences and help you a bit more.


Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...