Eventia Reporting

[Raedm]

- I am trying to run Eventia Reporting against the log files located on the Smart Center Server under /opt/CPsuitr-R60\fw1\log.

- When I access Eevntia Reporting I receive the following message " No consolidation sessions are currently processing the log sequence, therefore, new created logs are not being added to the DB. In order to create consolidation session, please go to the Management View and select sessions tab under consolidation subject"

- Under management, consolidation, sessions tab, select create new, select the Smart Center IP address, under log files and database for consolidation sessions, select default log files & database (I also tried customize), click finish. I receive the following error message " failed to get default parameters from server/database".

- I am using the default database table (CONNECTIONS).

- I tried to run a report and the results is empty " no relevant data found"

Any suggestions?

[Porter]

how is Eventia installed? As standalone with plugin on the smartcenter or fully installed on the smartcenter?

[Raedm]

Standalone installation only. The smart center server is also the log server.

[Raedm]

I receive the following error message when I try to connect to the smart center server fro m Eventia Reporter GUI " Failed to get log file list from server/database when:

On the Eventia Reporter Server and SmartView Reporter Server GUI client

1. Select the Management > Consolidation > Sessions tab.
2. In the Session tab, click "Create New".
3. From the "New Consolidation Session" dialog box, select the appropriate log server from the "Select log server" screen.
4. Click "Next".
5. Chose the "Select default log files and database" option.
6. Click "Finish".

[Porter]

have you installed the plugin for eventia on the smartcenter?

have you selected the right CP products for the node?

and of course the sic between the node and smartcenter is established?

if those things are done you should able to succesfully run -> management, consolidation, sessions tab, create new, select the Smart Center IP address, under log files and database for consolidation sessions, select default log files & database

[kva.kva]

Did you try this - https://secureknowledge.checkpoint.c....do?id=sk31538 and this - https://secureknowledge.checkpoint.c....do?id=sk31283 ?

[Raedm]

Clarification:

1- Used the production smart center server disk on stand alone smart center server (Solaris 9) with Checkpoint NGX R60 including stand alone Eventia Reporter.
2- the secondary smart center server is not connected to any firewall modules.
3- the smart center server store the firewall logs in the $FWDIR/log directory.
4- In Eventia Reporter\Management\Consolidation\sessions\ the smart center server to the CONNECTIOS database status is "trying to connect "
5- When I tried to generate a report, I receive the message " the report is set to be generated from the CONNECTIONS database table but this table is missing or empty"
6- I have attached the Eventia Reporter license to the smart center server.

Question: is possible to generate the reports this way? Or the smart center server has to be connected to the firewall modules?

[kva.kva]

Originally Posted by Raedm

4- In Eventia Reporter\Management\Consolidation\sessions\ the smart center server to the CONNECTIOS database status is "trying to connect "

You need that your consolidation status will be Processing Logs. Without this Logs from SC doesn't consolidate and Eventia doesn't have information for reports.