How do I Rotate the Audit Logs in FireWall-1 NG?

[BarryStiefel]

How do I Rotate the Audit Logs in FireWall-1 NG?



The VPN-1/FireWall-1 NG audit log type files are:

• xx.adtlog - stores the audit log records.
• xx.adtlogptr - provides pointers to the beginning of each log records.
• xx.adtloginitial_ptr - provides pointers to the beginning of each log chain (logs that shared the same connection ID - LUUID).
• xx.adtlogaccount_ptr - provides pointers to the beginning of each accounting record.

To purge/delete the current audit log files without saving it to a backup file, run:

# fw logswitch -audit ""

To logswitch and save the logs to a file, run:

# fw logswitch -audit

Example :

# fw logswitch -audit Trying to switch audit logfile to 2002-06-07_150016.adtlog Log File was switched to : 2002-06-07_150016.adtlog

-- GuyR - 08 Jan 2004

FAQForm FAQs.Class: LoggingAndAlertingFAQs FAQs.OS: FAQs.Version:

[hardhhhat]

Is there anyway to rotate the logs automatically on a windows management station? I can see how you can do it on a local FW machine but we want to do a logswitch on the management station to stop the logfiles getting too large and difficult to troubleshoot with. Currently we manually do it with the switch active command in the Smart Tracker Window?

[mdsenv]

Originally Posted by hardhhhat

Is there anyway to rotate the logs automatically on a windows management station? I can see how you can do it on a local FW machine but we want to do a logswitch on the management station to stop the logfiles getting too large and difficult to troubleshoot with. Currently we manually do it with the switch active command in the Smart Tracker Window?

Edit the object for the SmartCenter server in the GUI. You can auto switch by time or by log size.

[hardhhhat]

dmsenv - thanks it's pretty obvious now you mention it - I was just looking at the fw's themselves doh!

Thanks,

HH

[sengkhoon]

Hi

I still cant find the GUI to alternate the logs based on size.
Please advised.

Thanks

[Sergej]

Is all the options under "Logs and Masers" in CheckPoint Gateway properties it not enough for you?