I came across an issue where the Check Point Security Gateway consistently stored the firewall logs locally as well as forwarding them to the Security Management server.
As a result the /var/log partition reached 100%.
Thinking this was the result of the Security Gateway having lost connection with the SM at some point (which makes it stores the log files locally) I tried approaching the issue by
- installing a policy
- Running the command cpstart
- Check connection with SM
I could also see the logs in SmartView Tracker and also confirm the SG had established a connection with the SM (Port TCP/257 is used for log transfer)
[Expert@chkp-sg1]# netstat -an | grep 257
tcp 0 0 127.0.0.1:58043 127.0.0.1:257 ESTABLISHED
tcp 0 0 10.20.30.1:39742 10.10.33.9:257 ESTABLISHED
After a bit of digging I found this box ticked off which explained it all.
The Security Gateway was in fact, incorrectly, configured to store the logs locally.