troubleshooting splunk-checkpoint communication


I am evaluating Splun 4.x as my log file analyzer for a Checkpoint UTM-1. I followed the procedures for configuring an LEA connector & setting up OPSEC. It appears that Splunk is running & making LEA requests of the Checkpoint, but I get no data logged on Splunk.

How can I best go about troubleshooting this? What log files or debug commands can i use to trace down the fault?

I appreciate your help. Jonathan



We are also interested in your package... possible to take a look?


Cheers, Vincent

0 Karma



We are experiencing the exact same behaviour than ‘Starlette’ in We are interested to your package with the patch. We are running on RedHat 5-64. How can we get it?


Cheers, JP

0 Karma

Path Finder

jonathanhowell -

Splunk's lea_loggrabber app is open-source. I have a patch which enables more verbose logging - quite useful for debugging lea_loggrabber issues. (It also includes a few other enhancements.) It's working very well for months now, not only in my environment but elsewhere. I've requested Splunk to either grant me commit access to their google code project for lea_loggrabber or at least to review my patch and make it available. Unfortunately no action on their side to date, other than opening the source. Send me a direct message with your email address and I'll send you a package with the patch, readme, plus some support scripts and useful lookups.

Cheers, --Trey

Splunk Employee
Splunk Employee

Hello Trey,
Thank you for taking the time to enhance this app and share that with other users.
I'll send you my email address to get a copy of your package. I will give it a go and try to give some traction to your request if it proves helpful in troubleshooting jplaberge's issue.

0 Karma

Path Finder

The splunkd.log at $SPLUNK_HOME/var/log/splunk/ is usually good for this sort of troubleshooting. If for some reason an input is being skipped, this will often be the place that it's logged.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...