> Source: [sk182676](https://support.checkpoint.com/results/sk/sk182676)

# sk182676 - Threat Emulation malicious logs are cut during export through Log Exporter when UDP is in use

| Property | Value |
|----------|-------|
| Solution ID | sk182676 |
| Date Created | 2024-09-11 |
| Last Modified | 2024-09-15 |
| Technical Level | Advanced |
| Products | Logging & Status |
| Versions | R81.20 |
| Platform | TE |

## Symptoms

- * Malicious logs are not seen on 3rd party SIEM after export from the Check Point server using Log Exporter.

* Log exporter is configured to send logs over UDP.

* The `tcpdump` of the source server (with -A flag for raw print) shows that malicious logs are exported but are cut after export or in the middle of some arbitrary field.

## Cause

Malicious detections for Threat Emulation create a very big log file, and while SmartConsole is able to parse all the information, when we export the logs with Log Exporter, we must take into consideration the MTU value for the interfaces (export, in between, and target).  

If the value of the MTU is less than the size of the bytes required for the "malicious" verdict log to be sent over UDP, it is cut and not all information is transferred.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content