What does the FWD daemon instruct the gateway to do when communication issues between the gateway and SMS/Log Server occur?

The FireWall Daemon (FWD) process on a Security Gateway is responsible for handling and forwarding logs. If the connection to the Security Management Server (SMS) or a dedicated Log Server is lost, the FWD daemon initiates a process called "log spooling." It saves the generated logs to files on the gateway's local disk (typically in the $FWDIR/log/ directory). The FWD process periodically attempts to re-establish the connection. Once communication is restored, it forwards the spooled logs from the local files to the Log Server, ensuring no log data is lost during the outage.

A. This is imprecise. While logs are "held," the specific mechanism is local disk storage on the gateway, not a conceptual "holding queue for the server." Option C is more accurate.
B. This is incorrect. Stopping logging would create a critical security visibility gap. Check Point's architecture is designed for resilience and ensures continuous logging even during connectivity issues.
D. This is incorrect. The Security Policy defines what events to log, not a quantitative limit on the number of logs to store during a communication failure.

1. Check Point R81.10 Security Administration Guide, Chapter "Logging and Monitoring", Section "Logs", Subsection "Log Forwarding and Spooling".

The guide states: "If the Security Gateway cannot connect to the Log Server, the Security Gateway saves the logs in a spool file locally. When the connection is restored, the Security Gateway sends the logs from the spool file to the Log Server."

2. Check Point Support Center, sk92443: "How to configure Log Spooling on Security Gateway".

This official support document explicitly states: "When the connection between a Security Gateway and its Log Server is down, the Security Gateway spools the logs locally. When the connection is restored, the Security Gateway sends the spooled logs to the Log Server."

3. Check Point Support Center, sk170516: "ATRG: Logging".

In the "Log Spooling" section, it details the process: "If the connection to the Log Server is lost, the Security Gateway will start spooling logs locally to the disk. Once the connection is restored, the Security Gateway will send the spooled logs to the Log Server." This document confirms that fwd handles this process.