How to View Logs and Generate Reports in Check Point SmartConsole

Check Point SmartConsole and SmartView provide powerful logging and reporting capabilities for monitoring security events, analyzing traffic patterns, and generating compliance reports. This guide walks you through accessing logs, creating custom views, and automating report generation.

Prerequisites

Before you begin, ensure you have:

• SmartConsole installed with log viewing permissions
• Security Gateway configured to send logs to the Management Server
• Logging enabled on relevant firewall rules (Track column)
• Optional: SmartEvent Server for advanced correlation and reports
• Optional: Mail server configured for automated report delivery

Understanding Check Point Logging

Check Point generates several types of logs:

Step 1: Access Logs in SmartConsole

Opening the Logs View

1. Open SmartConsole and connect to your Management Server
2. Click Logs & Monitor in the left navigation panel
3. The default Logs view opens showing recent security events
4. Use the time selector in the top-right to adjust the time range

Understanding the Log View Interface

Step 2: Search and Filter Logs

Basic Search

Type in the search bar to find logs containing specific text:

• 192.168.1.100 - Find logs with this IP address
• blocked - Find logs with blocked actions
• malware - Find Threat Prevention logs

Advanced Query Syntax

Check Point uses a structured query language:

blade:firewall action:drop

src:10.0.0.0/8 dst:8.8.8.8 service:DNS

blade:"Anti-Bot" severity:critical

Common Query Fields

Using the Filter Panel

1. Click the Filter icon to expand the filter panel
2. Select filters from available categories:
   • Blade: Firewall, Application Control, Threat Prevention
   • Action: Accept, Drop, Reject, Detect
   • Severity: Critical, High, Medium, Low
3. Click filter values to add them to your query
4. Combine multiple filters for precise results

Step 3: Analyze Individual Log Entries

Viewing Log Details

1. Click any log entry in the table
2. The Log Details panel expands below
3. View comprehensive information:
   • General: Time, action, rule matched
   • Source/Destination: IPs, users, interfaces
   • Service: Protocol, port, application
   • Threat Prevention: Attack name, severity, CVE
   • Additional Info: Bytes, duration, matched policy

Understanding Log Fields

Log Actions

Right-click a log entry for additional actions:

• Copy - Copy log details to clipboard
• Search - Use field value as search query
• Whois - Look up IP address information
• Show Policy - Jump to the matching rule
• Create Exception - Add Threat Prevention exception

Step 4: Use Predefined Views

SmartConsole includes built-in views for common monitoring needs:

Accessing Predefined Views

1. In Logs & Monitor, click the + tab
2. Browse the Catalog of available views
3. Categories include:
   • Access Control - Firewall traffic analysis
   • Threat Prevention - Security threat overview
   • VPN - Tunnel status and traffic
   • User & Identity - User-based activity
   • Network - Bandwidth and connection analysis

Popular Predefined Views

Step 5: Create Custom Views

Build views tailored to your specific needs:

Creating a New View

1. Go to Logs & Monitor
2. Click the + tab > New View
3. Enter a Name and select a Category
4. Optionally add a Description
5. Click OK to open the view editor

Adding Widgets

Views are composed of widgets that display data:

1. Click Add Widget in the view editor
2. Choose widget type:
   • Timeline - Events over time
   • Table - Detailed log entries
   • Chart - Bar, pie, or line graphs
   • Map - Geographic visualization
   • Infographic - Key metrics display
   • Rich Text - Static text and instructions

Configuring Widget Queries

1. Click Edit on a widget
2. Define the query:
   • Use the visual query builder, or
   • Enter advanced query syntax
3. Select fields to display
4. Configure sorting and limits
5. Set refresh interval

Example: Top Blocked Applications View

Widget 1 - Chart:

• Type: Horizontal Bar
• Query: action:drop blade:"Application Control"
• Group by: Application Name
• Show top 10

Widget 2 - Timeline:

• Query: action:drop blade:"Application Control"
• Display events over time

Widget 3 - Table:

• Query: action:drop blade:"Application Control"
• Columns: Time, Source, Application, Rule

Step 6: Access SmartView Web Application

SmartView provides browser-based access to logs and reports:

Accessing SmartView

1. Open a web browser
2. Navigate to: https://<management-server-ip>/smartview/
3. Log in with your SmartConsole credentials
4. The SmartView interface loads with familiar views

SmartView Features

SmartView User Preferences

1. Click your username in the top-right
2. Select User Preferences
3. Configure:
   • Locale: Display language
   • First day of the week: Weekly report start day
   • Theme: Default or High Contrast
   • Default time frame: Initial log filter period

Step 7: Generate Reports

Create professional reports for management or compliance:

Quick Report Generation

1. Open any view in SmartConsole or SmartView
2. Click the Export icon
3. Choose format:
   • PDF - Formatted document with charts
   • CSV - Data export for spreadsheets
4. Configure options:
   • Time range
   • Include/exclude widgets
5. Click Export

Scheduled Reports

Automate recurring report delivery:

1. Open the view you want to report
2. Click the Schedule icon (clock symbol)
3. Configure schedule:
   • Frequency: Daily, Weekly, Monthly
   • Day/Time: When to generate
   • Time Range: Last 24 hours, Last week, etc.
4. Configure delivery:
   • Recipients: Email addresses
   • Format: PDF or inline HTML
   • Subject: Custom email subject
5. Click Save Schedule

Report Prerequisites

For email delivery, configure mail server:

1. Go to Manage & Settings > Blades > Logging & Monitoring
2. Configure Mail Server settings:
   • SMTP server address
   • Port (25, 465, or 587)
   • Authentication if required
   • From address

Step 8: Configure Log Forwarding

Send logs to external systems for long-term storage or SIEM integration:

Syslog Forwarding

1. Go to Manage & Settings > Blades > Logging & Monitoring
2. Click Log Servers > Add > External Log Server
3. Configure:
   • Name: Descriptive name
   • Type: Syslog
   • Address: Syslog server IP
   • Port: Usually 514 (UDP) or 6514 (TLS)
   • Format: CEF or LEEF
4. Select which log types to forward
5. Install policy to activate

Log Exporter

For advanced integrations, use Check Point Log Exporter:

# Install on Management Server
cplog_export -h

# Configure export target
cplog_export -t syslog -a <siem_ip> -p 514 -f cef

Step 9: Monitor System Health

Beyond security logs, monitor gateway and system status:

Gateway Status View

1. Go to Logs & Monitor
2. Select the Gateways & Servers view
3. Monitor:
   • Gateway online/offline status
   • CPU and memory usage
   • Policy installation status
   • License status

Setting Up Alerts

Configure alerts for critical events:

1. Go to Manage & Settings > Blades > Logging & Monitoring
2. Click SmartView Monitor Settings
3. Configure alert actions:
   • Pop-up notification
   • Email notification
   • SNMP trap
   • User-defined script

Troubleshooting Common Issues

Logs Not Appearing

Symptoms: No logs visible for recent traffic.

Solutions:

1. Verify Track column is set to "Log" on relevant rules
2. Check gateway connectivity to Management Server
3. Verify log server disk space
4. Check time synchronization between gateway and management
5. Publish and install policy after adding logging

Slow Log Queries

Symptoms: Searches take too long.

Solutions:

1. Narrow the time range
2. Use more specific queries
3. Add indexed fields to queries (src, dst, action)
4. Check log server performance (CPU, disk I/O)
5. Consider log indexing optimization

SmartView Not Accessible

Symptoms: Cannot reach SmartView web interface.

Solutions:

1. Verify Management Server is running
2. Check HTTPS connectivity (port 443)
3. Confirm SmartView is enabled: api status from CLI
4. Clear browser cache and cookies
5. Try different browser

Best Practices Summary

Next Steps

After mastering logging and reporting:

1. SmartEvent - Deploy SmartEvent for advanced correlation
2. SIEM Integration - Connect to your SIEM platform
3. Custom Dashboards - Build executive security dashboards
4. Automated Responses - Configure automatic actions for specific events
5. Compliance Reporting - Create compliance-specific report templates

Additional Resources

• Check Point Logging and Monitoring Admin Guide
• SmartView Web Application Guide
• Views and Reports Documentation
• Check Point CheckMates Community

Need help with Check Point monitoring and reporting? Inventive HQ provides expert configuration, SIEM integration, and managed security monitoring services. Contact us for a free consultation.