> Source: [sk55020](https://support.checkpoint.com/results/sk/sk55020) # sk55020 - How to generate a log parser for third-party syslog records | Property | Value | |----------|-------| | Solution ID | sk55020 | | Date Created | 2010-10-04 | | Last Modified | 2025-06-22 | | Technical Level | General | | Products | Security Management Server | | Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) | ## Solution ### Generating the Syslog Parser **Warning - Follow the instructions below carefully. If not done properly, this could prevent the syslog process from running.** 1. Install the [Eventia Log Parsing Editor](https://support.checkpoint.com/results/download/7896) tool on your Windows OS computer. This tool allows you to easily define parsing files for third-party syslog records based on syslog samples. 2. Open the **Eventia Log Parsing Editor** application. 3. Read syslog samples from a file or the clipboard. They will then be analyzed by the Syslog Parser GUI. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk55020/image002.gif) Log samples are analyzed and combined into patterns. **Many text sections that are recognized as variable (dates, numbers, IP addresses) are detected automatically.** ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk55020/image003.gif) 4. Define variable sections which will add data to the log fields and will also help combine these patterns. To define the sections manually, highlight them with the mouse and then click**Define Highlighted Text** to bring up the **Selection Definition** window. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk55020/image004.gif) ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk55020/image005.jpg) After selecting the field, the field type and its regular expression pattern is identified automatically. You can associate it with a log field. In our example, the log identifies a type of alert, so you associate it with a new log field "**AlertType**". ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk55020/image006.jpg) 5. Some fields (like "`action`" or "`protocol`") may have different names in the syslog record than is normally expected in the logs. For instance, our log contains the values "`permitted`" and "`denied`" instead of the standard Check Point values "`accept`" and "`reject`". A dictionary maps these syslog values to expected values. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk55020/image007.gif) The dictionary editor allows you to add new mappings from the syslog value to the Log Server value. Most common dictionaries are already defined. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk55020/image008.jpg) 6. This is what it should look like after defining all the relevant sections: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk55020/image009.jpg) 7. The "`product`" field is special since it is key to interpreting a log's values. There is a section at the bottom of the screen to define the product. If the logs contain identifying text, then it is used for product identification. Otherwise, the fact that you have successfully parsed a log is sufficient to identify the product. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk55020/image010.gif) 8. Click "**Simulate Current Parsing File**" to simulate the results with a new sample file to verify that your definitions are correct. Unsuccessfully parsed samples can be added back to the pattern list to improve parsing. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk55020/image011.gif) 9. Click "**Generate**" to generate the set of parsing files that will be copied to the Eventia log server. The files that will be generated are **\.C** and **\-dict.ini** (when dictionaries are used), where **\** is the name you choose for the parser file. 10. Save your project in a project file (click **Menu** \> **Save**). This way you can modify the definitions in the future. **Note:** It is not possible to create projects from existing parsing files automatically, so keep this valuable information. ### Installing the Syslog parser on the relevant Log server: Once the Syslog parsing file is created, deploy it in the Log Server by following these instructions: 1. To install or remove parser files and dictionary files on the Log Server, you must first install the Log Server File Utility on the Log Server. The Log Server File Utility is supplied as a file called "`addParsingFile`" and comes in different versions according to the Log Server's operating system. Take the utility file from Eventia Log Parsing Editor's installation directory, from the directory named like your Log Server's operating system. For example, if your Log Server runs on the Windows OS, and you installed Eventia Log Parsing Editor in the default location, take this file: **C:\\Program Files\\Eventia Log Parsing Editor\\Windows\\addParsingFile.exe** To install this utility on the log server, copy it on the Log Server. * If the Log Server runs on the Check Point Gaia OS / Check Point SecurePlatform OS / Solaris OS, then copy the utility to this directory: `$FWDIR/bin/` and assign the required permissions: `chmod -v 750 $FWDIR/bin/addParsingFile` * If the Log Server runs on the Windows OS, then copy the utility to this folder: `%FWDIR%\bin\` 2. Install the Parsing and Dictionary files on your Log Server: 1. Copy the parsing file and, if relevant, the dictionary file, to the Log Server to some directory. 2. On the Log Server's command line, run: `addParsingFile -p [-d ]` For more explanation about the command flags, see the [Eventia Log Parsing Editor Administration Guide](https://sc1.checkpoint.com/documents/PDF/sk55020_Eventia_Log_Parsing_Editor_Administration_Guide.pdf). **Important Note** - Running the "`addParsingFile`" command on the Gaia OS will automatically restart the Check Point services on the Log Server. 3. Activate Syslog parsing on the Log Server: 1. Edit the Log Server object: * In SmartConsole R80 and higher: 1. Connect with SmartConsole to the Management Server that managers the Log Server. 2. In the left panel, expand the "**Logs** " section and click the "**Additional Logging Configuration**" page. 3. Select the checkbox "**Accept Syslog messages**". 4. Click **OK**. 5. If this is a dedicated Log Server, then Install Database on all objects (click the **Menu** button \> click **Install database** \> select all objects \> click **Install**). * In SmartDashboard R77.30 and lower: 1. Connect with SmartDashboard to the Management Server that managers the Log Server. 2. Open the Log Server object and click the **Additional Logging Configuration** tab. 3. Select the checkbox "**Accept Syslog messages**". 4. Click **OK**. 5. If this is a dedicated Log Server, then Install Database on the Log Server. 2. Restart the Check Point services on the Log Server: `cpstop` `cpstart` 3. Only in the version R80.10 - manually restart the *syslogd* daemon: `service syslog restart` ### Verifying that the Syslog parser works properly The required parsing files are now installed on the Log Server. It will parse and translate the received syslog records according to the instructions in these parsing files. Examine the logs in SmartConsole / SmartView / SmartLog / SmartView Tracker - to make sure the syslog entries are indeed being parsed properly to the desired fields. ### Related Documentation * [Eventia Log Parsing Editor Administration Guide](https://sc1.checkpoint.com/documents/PDF/sk55020_Eventia_Log_Parsing_Editor_Administration_Guide.pdf) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content