how to backup logs weekly

[sebastan_bach]

hi all can some tell me the procedure for backing up the logs weekly.

any help would be great.

regards

sebastan

[northlandboy]

Within SmartDashboard, I'd configure daily log rotation, generally at midnight.

Then (assuming you're using a Unix variant as your log server), I'd run a script to compress anything older than a week, and then copy them to wherever you want them copied to for backup - e.g. scp them somewhere else, or copy to tape, or however it is you want to back them up.

One thing to consider is how long you will be backing them up for, and whether it is acceptable to store them in Check Point format, or if you need to store them in a plaintext format. Consider what might happen if you needed to read a logfile from 7 years ago - it would probably be in 4.1 format, and you would have to set up a 4.1 server to read them - but you probably wouldn't be able to find the installation CD. So some places have a policy of running fw logexport, then backing up the text files.

[sebastan_bach]

hi mate thanks a lot for ur reply .mate
does running the upgrade export on the log servers will backup the logs as well. and can we set the log backup from daily to weekly as well.

thanks a lot buddy.

regards

sebastan

[northlandboy]

It's been a while since I configured it, but off the top of my head, the backup option on SPLAT included an option as to whether or not to include the logs. Can't remember if upgrade_export includes them - think not.

Yes you can set the logs to rotate whenever you want. Set up a time object for the right time/frequency, then configure it on the management server object in SmartDashboard. Otherwise use fw logrotate from cron.

[sebastan_bach]

thanks a lot mate .thanks for ur reply.

regards

sebastan

[cciesec2006]

Originally Posted by northlandboy

It's been a while since I configured it, but off the top of my head, the backup option on SPLAT included an option as to whether or not to include the logs. Can't remember if upgrade_export includes them - think not.

Yes you can set the logs to rotate whenever you want. Set up a time object for the right time/frequency, then configure it on the management server object in SmartDashboard. Otherwise use fw logrotate from cron.

upgrade_export does NOT include log.

[Thorpuse]

Originally Posted by cciesec2006

upgrade_export does NOT include log.

Correct. On SPLAT there is a switch to allow the backup command to include logs - but that means it backs up all the logs in your $FWDIR/log directory, which can make your backups pretty huge.

[sebastan_bach]

thanks guys for the info.

regards

sebastan