trouble-shooting checkpoint opsec

[a212830]

Hi,

I installed the Splunk CHeckpoint/Opsec app. The app installed, and according to splunkd.log, the script is running, but in the "Manage Connections" page, the entry is listed as "never connected". The logfile is not pulling back any data (all zero bytes). Is there a way to see what is happening in the script?

[sowings]

Yes, there's a debug version of the polling script in the bin directory of the app. You can run that with the name of your config entity to see what's going on. You might want to redirect it to a file to capture it all.

Note that I've typically found that I have to restart the Splunk instance to refresh the Checkpoint's config REST endpoints. You might have to do this after you edit the config file.

[Chubbybunny]

http://answers.splunk.com/answers/89743/what-is-the-easiest-way-to-debug-the-check-point-opsec-lea-a...