Not receiving audit logs OPSEC LEA since upgraded Checkpoint FW R77 to R80.1

[splunkreal]

Hello,

we don't receive audit logs anymore since upgrade from R77 to R80.1, anyone has an idea? FW logs are OK.

Should we switch to Checkpoint app for Splunk : https://splunkbase.splunk.com/app/4293/ using Log exporter?

Thanks for your help.

Splunk Enterprise 7.3.4 / OPSEC LEA app 5.0

[splunkreal · Accepted solution]

deleting /splunk/var/lib/splunk/modinputs/checkpoint_opseclea/Audit_audit then splunk restart solved the problem.