> Source: [sk106039](https://support.checkpoint.com/results/sk/sk106039) # sk106039 - How to forward log file from Security Management Server to a Log Server without deleting the local log file | Property | Value | |----------|-------| | Solution ID | sk106039 | | Date Created | 2015-05-12 | | Last Modified | 2025-05-21 | | Technical Level | General | | Products | Security Management Server, Multi-Domain Security Management Server | | Versions | R82.10, R82, R81.20, R82.20 | ## Solution **Note: This article also applies to R80.x versions.** **Table of Contents:** * Background * Procedure * Related documentation * Related solutions Background {#Background} ------------------------ It is possible to configure Security Management Server / Domain Management Server to forward its Check Point log files to another Log Server. By design, Security Management Server / Domain Management Server will delete its local Check Point log files after forwarding it to a Log Server. There are cases, when the local Check Point log files should be kept on the Security Management Server / Domain Management Server after forwarding it to a Log Server. Procedure {#Procedure} ---------------------- Follow these steps to configure the Security Management Server / Domain Management Server to forward log files to a Log Server without deleting it: 1. Enable log forwarding on Security Management Server / Domain Management Server: 1. In SmartDashboard / SmartConsole, open Security Management Server / Domain Management Server object. 2. Go to the ***Logs*** - ***Additional Logging Configuration***. 3. Check the box ***Forward log files to Log Server***. *Example*: [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106039/SmartDashboard.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106039/SmartDashboard.png "Click the image to see it in full size in a new tab/window") 4. Select the Log Server object, to which the log files should be forwarded. 5. Select/create the forwarding schedule. 6. Click on OK to apply the changes. 7. Save the changes. 8. Go to the ***Policy*** menu - click on the ***Install Database...*** - select all objects. 9. Go to the ***Policy*** menu - click on the ***Install Policy...*** - select all managed objects. 2. Configure the Security Management Server / Domain Management Server to keep the local file after forwarding it to a Log Server: 1. Close all SmartConsole windows (SmartDashboard, SmartView Tracker, SmartView Monitor, etc.). 2. Connect with [GuiDBedit Tool](http://supportcontent.checkpoint.com/solutions?id=sk13009) to the Security Management Server that manages the forwarding log server. 3. In the left upper pane, Go to the ***Table*** - ***Network Objects*** - ***network_objects***. 4. In the right upper pane, select the object of the Security Management Server / Domain Management Server. 5. Press CTRL+F (or Go to the ***Search*** menu - ***Find*** ) - paste ***forward_log_without_delete*** - click on the ***Find Next***. 6. In the lower pane, right-click on the ***forward_log_without_delete*** - click on the ***Edit...*** - choose ***true*** - click on the ***OK***. *Example*: [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106039/GuiDBedit_Tool.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106039/GuiDBedit_Tool.png "Click the image to see it in full size in a new tab/window") 7. Save the changes: Go to the ***File*** menu - click on the ***Save All***. 8. Close the GuiDBedit Tool. 9. Connect with SmartDashboard / SmartConsole to the Security Management Server that manages the forwarding log server. 10. Go to the ***Policy*** menu - click on the ***Install Database...*** - select all objects. 11. Go to the ***Policy*** menu - click on the ***Install Policy...*** - select all managed objects. 3. For Security Management Server / Multi-Domain Security Management Server ***R76 / R77.X***, a hotfix is required. *Issue Description* : Security Management Server / Domain Management Server forwards local log files to a Log Server as scheduled. However, instead of forwarding only the new log files that were created since the last scheduled forwarding event, *all* existing local log files are forwarded (i.e., also all those local log file that were already forwarded during the past scheduled forwarding events). This problem was fixed. The fix is included in: * [Check Point R80](http://supportcontent.checkpoint.com/solutions?id=sk108623) * [Jumbo Hotfix Accumulator for R77.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106162) - since *Take_15* * [Jumbo Hotfix Accumulator for R77.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101975) - since *Take_156* Check Point recommends to always upgrade to the most recent version ([upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [upgrade Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166)). For **other [supported](http://www.checkpoint.com/support-services/support-life-cycle-policy/index.html) versions** , [contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get the required **Hotfix** . A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification, please collect [CPinfo file](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server / Multi-Domain Security Management Server involved in the case. **Hotfix installation instructions:** 1. Hotfix has to be installed on ***Security Management Server / Multi-Domain Security Management Server***. **Note:** In Management HA environment, this procedure must be performed on *both* Management Servers. 2. Procedure: * Using CPUSE - On Management Server running Gaia OS: Make sure to install the [latest build of the CPUSE Agent](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest build of CPUSE and What's New). Refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE): * Section "[(4-A-c)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Portal)" / "[(4-A-d)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Clish)" - refer to import instructions for *Offline procedure* * Section "[(4-B-a)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to install a CPUSE package - Installing a Hotfix package / Minor Version package)" - refer to installation instructions for *Hotfixes* **Note:** Reboot is required. * Using Legacy CLI - On Management Server running SecurePlatform/Linux/IPSO OS: Note: You should be connected over Console. 1. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*). 2. Unpack and install the hotfix package: ***\[Expert@HostName\]# cd /some_path_to_fix/*** ***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\.tgz*** ***\[Expert@HostName\]# ./fw1_wrapper_\*** **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen. 3. Reboot the machine. Related documentation {#Related documentation} ---------------------------------------------- * Security Management Server Administration Guide ([R70](http://supportcontent.checkpoint.com/documentation_download?id=8745), [R70.20](http://supportcontent.checkpoint.com/documentation_download?id=10510), [R71](http://supportcontent.checkpoint.com/documentation_download?id=10315), [R75](http://supportcontent.checkpoint.com/documentation_download?id=11667), [R75.20](http://supportcontent.checkpoint.com/documentation_download?id=12277), [R75.40](http://supportcontent.checkpoint.com/documentation_download?id=13953), [R75.40VS](http://supportcontent.checkpoint.com/documentation_download?id=16301), [R76](http://supportcontent.checkpoint.com/documentation_download?id=22920), [R77.X](http://supportcontent.checkpoint.com/documentation_download?id=24830), [R80](http://downloads.checkpoint.com/dc/download.htm?ID=46534) / [R80](http://downloads.checkpoint.com/dc/download.htm?ID=46535), [R80.10](http://downloads.checkpoint.com/dc/download.htm?ID=54842)). * Multi-Domain Security Management Administration Guide ([R70](http://supportcontent.checkpoint.com/documentation_download?id=8741), [R71](http://supportcontent.checkpoint.com/documentation_download?id=10311), [R75](http://supportcontent.checkpoint.com/documentation_download?id=11683), [R75.20](http://supportcontent.checkpoint.com/documentation_download?id=12273), [R75.40](http://supportcontent.checkpoint.com/documentation_download?id=13950), [R75.40VS](http://supportcontent.checkpoint.com/documentation_download?id=16201), [R76](http://supportcontent.checkpoint.com/documentation_download?id=22916), [R77.X](http://supportcontent.checkpoint.com/documentation_download?id=24807), [R80](http://downloads.checkpoint.com/dc/download.htm?ID=46532) / [R80](http://downloads.checkpoint.com/dc/download.htm?ID=46535), [R80.10](http://downloads.checkpoint.com/dc/download.htm?ID=54841)). * Command Line Interface Reference Guide ([R70](http://supportcontent.checkpoint.com/documentation_download?id=8713), [R71](http://supportcontent.checkpoint.com/documentation_download?id=10324), [R75](http://supportcontent.checkpoint.com/documentation_download?id=11657), [R75.20](http://supportcontent.checkpoint.com/documentation_download?id=12264), [R75.40](http://supportcontent.checkpoint.com/documentation_download?id=13944), [R75.40VS](http://supportcontent.checkpoint.com/documentation_download?id=16262), [R76](http://supportcontent.checkpoint.com/documentation_download?id=22909), [R77.X](http://supportcontent.checkpoint.com/documentation_download?id=24833)). Related solutions {#Related solutions} -------------------------------------- * [sk94288 - $FWDIR/log/ directory on Security Management Server / Log Server contains FireWall log files named "HOSTNAME__YYYY-MM-DD_HHMMSS.log" and/or "HOSTNAME1__HOSTNAME2__YYYY-MM-DD_HHMMSS.log"](http://supportcontent.checkpoint.com/solutions?id=sk94288) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content