> Source: [sk164454](https://support.checkpoint.com/results/sk/sk164454)

# sk164454 - Client log files do not contain logs of more than a few minutes past

| Property | Value |
|----------|-------|
| Solution ID | sk164454 |
| Date Created | 2020-01-05 |
| Last Modified | 2020-01-06 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | macOS |

## Symptoms

- * The client log files do not contain logs of more than a few minutes past, making it difficult to collect informative logs after a problem occurs.
* Some client logs are missing from the log files.

## Cause

There are five log files: each is 10MB and written in a cyclic manner again and again. For logs that are extremely frequent, e.g., traffic related logs, this is not sufficient. There are other logs which are not traffic related that are also extremely frequent.

The user gets many log records for each packet the goes through the client. During network traffic, all five log files might be enough to hold only a minute or two of history.

<br />

<br />

## Solution

The Log Reduction feature is a new logging mechanism. While previous clients could either enable or disable logs, now the client has more options.

For E82.10 and higher, when logs are enabled, the client has two logging modes:

* **Basic** (default behavior): Basic mode filters very common logs which are mostly traffic related. In addition, it excludes log records with specific and configurable topics. A default list of excluded topics is configured in the *trac.defaults* configuration file.
* **Extended**: Extended mode writes all log records to the client log files.

To disable logs altogether, uncheck **Enable logging** in the **Advanced** tab under **VPN Options**.

To add or remove topics from the default list: In *trac.defaults* , search for the attribute **excluded_log_topics** . This is a string of topics that will be excluded from the logs when the logging method is set to **basic**. As mentioned above, a default list of topics is already configured.

**Syntax explanation**:

* **tcpserver\>=5\&#TR_SCVPOLICY\>=5\&#** : This means that log records that belong to the topic **tcpserver** or **TR_SCVPOLICY**and whose log level is 5 or higher (where 1 is most important and 6 is most common) will be excluded.
* **\&#** is a separator between each item.
* Supplying the frequency level is not mandatory. If no level is provided, any log with the topic will be excluded.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content