Error regarding Checkpoint OPSEC LEA

[kartreddy4]

I have installed the splunk Add-on on the Heavyforwarders and when trying to establishing the connection over TCP 18184 and hitting on save, its throwing up this error

External handler failed with code '1' and output: 'REST ERROR[400]: Bad Request - GNU C library (glibc.i686 32-bit and pam.i686) is missing.'. See splunkd.log for stderr output.

1. Do i need to install the 32bit lib files as requirement ?

2. Is configuring add-on, on the heavyfowarders the recommended way?

3. The checkpoint servers in my company are very outdated currently running major version R70 but the minimum requirement in splunk is R76 ? will it still work when configured. Please help

[jchapell]

@gjanders is right, you will need the libraries installed, configuring on the heavy forwarder is the desired method, and as for working with r70, if you can find an older version of the app, it may work. I would personally look into upgrading my checkpoint instances to r80.10. I just moved ours from r77.30 to r80.10 and couldn't be happier with them after working out some kinks.

[gjanders · Accepted solution]

(1) Yes, or at least in the older versions you did
(2) Yes
(3) No idea, you might have to test it and see but I suspect Splunk support would be "best effort" if your using an incompatible version of the firewall logging server!