Splunk Checkpoint FW grabber collecting more logs than the one of the logserver

[theouhuios]

I have a strange case where we see more logs in Splunk from the Checkpoint App than the ones in the Checkpoint log server itself. I did check for duplicates but even then we still see that Splunk has about 15-20% more logs than the checkpoint Server. We are running it on online mode.

We did have few issues with Checkpoint and Splunk has asked us to switch the THP setting off which we are working with the Unix team to see if its okay with them.

Any ideas? has anyone seen this issue before?

[matthieu_araman]

Hello,

I think what you are seen is that the same log is updated in checkpoint -> still one log in checkpoint as the log server can update directly a log entry afterwards.
But as you already collected it, you have two different logs in splunk.

example :
you've got a connection opening -> one log
the connection close and you've got accounting checked in checkpoint -> checkpoint update only the bytes column but you may see another log when collecting remotely.

there's also a log grace setting in Checkpoint but I think it should be transparent seen from splunk (ie you only see one log if the event is the same for the grace period which is by default 62s I think)

So I would say it's a feature.

You could try collecting with a delay to see it change the percentage.

[theouhuios]

Thanks for the answer. We don't have this issue now. This ticket is old.. about a year old.

[mbenwell]

Hi @theouhuios how did you solve this?

[theouhuios]

We changed the lea-loggrabber.sh script. This was suggested by Splunk as an unoffical answer. It worked for us. It might work for you too.

Changes we did were for the last line

#$SPLUNK_HOME/bin/splunk cmd python ./watchdog.py --restartlimit 10 --splunkpid $PPID --sipid $$ ./lea_loggrabber "$@" --appname $app_name
./lea_loggrabber "$@" --appname $app_name