Export logs via Syslog

Check Point syslog forwarding reference retained with a preference for supported Gaia logging configuration.

ⓘ

Validation status

Reviewed against the Check Point R82 Gaia Administration Guide on 27 September 2026.

!

Prefer supported Gaia syslog configuration

The legacy shell/startup pipeline below is retained as historical context. Use the current Gaia syslog commands for a new deployment.

Original technical reference

Forwarding Traffic Logs stored on the Management Server to Syslog Server

1. Add the below lines in the /etc/rc.d/init.d/cpboot file.

fw log -f -t -n -l 2> /dev/null | awk 'NF' | sed '/^$/d' | logger -p local4.info -t CP_FireWall &

2. After this we are able to see the firewall logs in the /var/log/message directory in addition to the original firewall logs as well.

3. Now, send these messages to remote syslog server. Configure the following in clish:

> add syslog log-remote-address <IP-address_of_Syslog_Server> level info

If you want to forward directly from gateways to syslog devices instead, create an OPSEC Syslog server (which require add-on sk105412), set the gateway to forward logs to this server, then set this flag on gateway:

# fw ctl set int fwsyslog_enable 1

And push the policy. (remember to set this to $FWDIR/boot/modules/fwkern.conf to persist across reboots)

Official and supporting references

• Check Point R82 - System Logging