[memnoch]

That worked a treat. Thanks a lot. One last question, is this command fully documented anywhere on Check Points site? The reason I ask is as I mentioned before if you do 'log_consolidator /?' you get the following:

USAGE: log_consolidator -R -s LogServerIP [-g PV1Customer]
-R Run the Log Consolidator Engine process for a specific consolidation session.
-s The IP address of the Log Server to read logs from.
-g Optional: The name of the Provider-1 customer for which this session is running.

USAGE: log_consolidator -V
-V Show the Log Consolidator Engine version & build number.

USAGE: log_consolidator -C -m [ start | stop | terminate | exit] -s LogServerIP [-g PV1Customer] [-r Port]
-C Send a command to the to the log consolidator session as specified by LogServerIP and PV1Customer.
-m Command. The command can be one of the following:
start - Start a stopped Log Consolidator Engine session with the last configuration.
stop - Stop (shutdown) a started Log Consolidator Engine session and write all pending information to the database.
terminate - Force the Log Consolidator Engine to terminate the consolidation immediately and discard pending information.
exit - Exit the main Log Consolidator Engine process (discards pending information).
-s The IP address of the Log Server to read logs from.
-g Optional: The name of the Provider-1 customer for which this session is running.

USAGE: log_consolidator -L -s LogServerIP [-g PV1Customer] [-r log_consolidator Port]
Get log file information from the log server and write the results to $RTDIR/conf/<session>/logs_info.conf.

USAGE: log_consolidator -M -s LogServerIP [-g PV1Customer] [-r log_consolidator Port]
Get a consolidation session's status information.

USAGE: log_consolidator -X -s LogServerIP [-g PV1Customer]
Check if a consolidation session's process is currently running.

This doesn't show many of the switches that you detailed.