> Source: [sk112335](https://support.checkpoint.com/results/sk/sk112335)

# sk112335 - Large number of IPS Geo protection logs affects the SmartEvent performance

| Property | Value |
|----------|-------|
| Solution ID | sk112335 |
| Date Created | 2016-07-18 |
| Last Modified | 2023-12-18 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server |
| Versions | R81.20, R81.10 (EOS), R81.20, R81 (EOS), R81.10 (EOS), R81 (EOS) |

## Symptoms

- Large number of IPS Geo protection logs affects the SmartEvent R80 performance (disk space, SmartEvent GUI, indexing rate, etc.).

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point R80.10](https://support.checkpoint.com/results/sk/sk111841)

Check Point recommends to always upgrade to the most recent version   
([upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=184) / [upgrade Multi-Domain Security Management](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=166)).

**Notes:**

* The solution is intended for dedicated SmartEvent server(s).
* This SK article is relevant for Correlated events anyway since the CPSEAD process read logs with LEA.

<br />

#### Configure the filter to ignore the IPS Geo protection logs:

1. Connect to command line on SmartEvent.
2. Log in to Expert mode.
3. Backup the `$INDEXERDIR/conf/log_indexer_settings.conf` file:  
   ***[Expert@HostName:0]# cp -v $INDEXERDIR/conf/log_indexer_settings.conf $INDEXERDIR/conf/log_indexer_settings.conf_ORIGINAL***
4. Run stopIndexer.
5. Edit the `$INDEXERDIR/conf/log_indexer_settings.conf` file in vi editor.
6. Locate the *:filter_logs* attribute.  

   **For R80, change** :  

   `:filter_logs ( `  
   `: ( `  
   `:log_field (product) `  
   `:filters ( `  
   `: ("VPN-1 & FireWall-1") `  
   `: ("HTTPS Inspection") `  
   `: ("VPN-1") `  
   `: ("Security Gateway/Management") `  
   `: ("Firewall") `  
   `)`  
   `) `  
   `: ( `  
   `:log_field (fw_subproduct) `  
   `:filters (`  
   `: ("VPN-1 & FireWall-1") `  
   `: ("HTTPS Inspection") `  
   `: ("VPN-1") `  
   `: ("Security Gateway/Management") `  
   `: ("Firewall") `  
   `)`  
   `)`

   **to:**

   `:filter_logs (`  
   `: (`  
   `:log_field (product) `  
   `:filters ( `  
   `: ("VPN-1 & FireWall-1") `  
   `: ("HTTPS Inspection")`  
   `: ("VPN-1")`  
   `: ("Security Gateway/Management") `  
   `: ("Firewall")`  
   `)`  
   `) `  
   `: ( `  
   `:log_field (fw_subproduct) `  
   `:filters ( `  
   `: ("VPN-1 & FireWall-1") `  
   `: ("HTTPS Inspection") `  
   `: ("VPN-1") `  
   `: ("Security Gateway/Management") `  
   `: ("Firewall") `  
   `)`  
   `)`  
   **: (**  
   **:log_field ("Protection Type")**  
   **:filters (**  
   **: ("geo_protection")**  
   **)**  
   **)**  
   `)`

   **For R80.10 and higher:** **uncomment**

   `: (`  
   ` ` `:log_field ("Protection Type") `  
   ` ` `:filters ( `  
   ` ` `: ("geo_protection") `  
   ` ) `  
   ` )`

   **put as last filter under** `:filter_out_by_field`

   Example:

   [![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk112335/Capture1712170211.JPG)](../SolutionsStatics/sk112335/Capture1712170211.JPG)

   [](../SolutionsStatics/sk112335/Capture1712170211.JPG)
7. Run startIndexer

**Important Note:** In an environment with Correlation Unit machine and SmartEvent server, the Consolidated Firewall sessions will be filtered out after installing this hotfix. To enable receiving events of this type, the ***filter_logs*** attribute should contain only the ***"Protection Type"*** filter. For example:

`:filter_logs (`  
`: (`  
`:log_field ("Protection Type") `  
`:filters ( `  
`: ("geo_protection") `  
`)`  
`)`  
`)`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content