# Check Point Elastic Agent

**URL:** <https://discuss.elastic.co/t/check-point-elastic-agent/304295>\
**Category:** Elasticsearch\
**Tags:** integrations\
**Created:** [May 9, 2022, 8:43pm UTC](https://discuss.elastic.co/t/check-point-elastic-agent/304295 "2022-05-09T20:43:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticnoobie](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@elasticnoobie](https://discuss.elastic.co/u/elasticnoobie)\
**Post date:** [May 9, 2022, 8:43pm UTC](https://discuss.elastic.co/t/check-point-elastic-agent/304295/1 "2022-05-09T20:43:21Z")

</div>

I'm working on setting up an elastic installation and forwarding all Check Point logs via Elastic Agent integration. I have setup Fleet, created the Agent Policy and installed the Elastic Agent on the Check Point management server. The agent will not send the fw.log file which contains all the firewall logs for network traffic. The integration description states that it utilizes the log exporter but doesn't provide any instructions for this. I've setup a manual cp\_log\_export but elastic is not ingesting the syslog logs from Check Point log exporter. Can someone help me understand where I'm going wrong?

Integration Config:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/4/941090dafab0b683421645bbee42b49bb488d99a.png)

Log Exporter Config:  
cp\_log\_export add name elastic target-host 10.1.1.10 target-port 9200 protocol tcp format syslog

---

<div class="post-metadata">

**Author:** ![elasticnoobie](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@elasticnoobie](https://discuss.elastic.co/u/elasticnoobie)\
**Post date:** [May 9, 2022, 8:57pm UTC](https://discuss.elastic.co/t/check-point-elastic-agent/304295/2 "2022-05-09T20:57:08Z")

</div>

Edit: cp\_log\_export add name elastic target-host 10.1.1.10 target-port 9001 protocol udp format syslog

---

<div class="post-metadata">

**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Post date:** [May 10, 2022, 8:58am UTC](https://discuss.elastic.co/t/check-point-elastic-agent/304295/3 "2022-05-10T08:58:44Z")

</div>

Hey @elasticnoobie

i haven't done anything with checkpoint yet, but here are some things i saw in your config:

- can you try to change the exporter to tcp? The syslog input on the elasticagent seems to be tcp (see Title of config line `input: tcp`).
- Maybe you also have to enter the Ip into the "Syslog Host" field so connection from outside on the server are allowed (are the connection coming from outside? not sure). Or it could be the other way around and you have to configure the log\_exporter to `target-host 127.0.0.1` because the Agent is only listening on localhost.

BR

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2022, 8:58am UTC](https://discuss.elastic.co/t/check-point-elastic-agent/304295/4 "2022-06-07T08:58:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.