troubleshooting splunk-checkpoint communication

[jonathanhowell]

I am evaluating Splun 4.x as my log file analyzer for a Checkpoint UTM-1. I followed the procedures for configuring an LEA connector & setting up OPSEC. It appears that Splunk is running & making LEA requests of the Checkpoint, but I get no data logged on Splunk.

How can I best go about troubleshooting this? What log files or debug commands can i use to trace down the fault?

I appreciate your help. Jonathan

[csoh]

Hi,

We are also interested in your package... possible to take a look?

Thanks

Cheers, Vincent

[jplaberge]

Trey

We are experiencing the exact same behaviour than ‘Starlette’ in http://answers.splunk.com/questions/947/splunking-my-checkpoint-firewall-logs We are interested to your package with the patch. We are running on RedHat 5-64. How can we get it?

Thanks

Cheers, JP

[treyka]

jonathanhowell -

Splunk's lea_loggrabber app is open-source. I have a patch which enables more verbose logging - quite useful for debugging lea_loggrabber issues. (It also includes a few other enhancements.) It's working very well for months now, not only in my environment but elsewhere. I've requested Splunk to either grant me commit access to their google code project for lea_loggrabber or at least to review my patch and make it available. Unfortunately no action on their side to date, other than opening the source. Send me a direct message with your email address and I'll send you a package with the patch, readme, plus some support scripts and useful lookups.

Cheers, --Trey

[hexx]

Hello Trey,
Thank you for taking the time to enhance this app and share that with other users.
I'll send you my email address to get a copy of your package. I will give it a go and try to give some traction to your request if it proves helpful in troubleshooting jplaberge's issue.

[Yancy]

The splunkd.log at $SPLUNK_HOME/var/log/splunk/ is usually good for this sort of troubleshooting. If for some reason an input is being skipped, this will often be the place that it's logged.