Check Point Log Exporter is an easy and secure method to export Check Point logs over syslog. Log Exporter is a multi-threaded daemon service which runs on a log server. Each log that is written on the log server is read by the Log Exporter daemon. It is then transformed into the applicable format and mapping and sent to the end target.
To export logs from Harmony Endpoint:
1-Go to Endpoint Settings > Export Events.
2-Click Add.
3-The New Logging Service window opens.
4-Fill in the export details:
Name - Enter a name for the exported information.
IP Address - Enter the IP Address of the CCE
Protocol - UDP.
Format - Select the CEF format
Port - 514
4-Click Add.
Note:
Now login on to the CCE and capture the PCAP with the help of the below command and share it with us.sudo tcpdump -i any port 514 and host <device_ip> -vw checkpoint.pcap.