Where would you look to find the error log file to investigate a logging issue on the Security Management Server?

The Check Point fwd process, also known as the FireWall Daemon, is responsible for handling logging traffic on both the Security Gateway and the Security Management Server. When troubleshooting an issue where logs are not being received or processed correctly by the Security Management Server, the first place to investigate is the error log for the fwd process. This file, fwd.elg, located in the $FWDIR/log/ directory, contains detailed error messages and debug information specifically related to the logging functionality, making it the most relevant file for diagnosing a "logging issue".

B. SCPDIR/log/cpd.elg: This is the error log for the Check Point Daemon (cpd), which is responsible for starting and monitoring other Check Point processes. It is not directly involved in log processing.
C. SMDSFWDIR/log/cpm.elg: This is the error log for the Check Point Management (cpm) process, which handles GUI client connections and API requests. It is not the primary process for receiving logs from gateways.
D. SFWDIR/log/fwm.elg: This is the error log for the fwm process, the main management process that handles database activities and policy installation. It is not responsible for the log collection mechanism.

1. Check Point Support Center, sk33208 - List of Check Point Processes: This official SecureKnowledge article describes the fwd process: "On Security Management Server, it is responsible for communication with the Security Gateways (for logging, policy download, etc.)." This establishes fwd as the key process for logging.

2. Check Point Support Center, sk165413 - Main log files on Gaia OS: This article explicitly lists the purpose of key log files. It states that $FWDIR/log/fwd.elg contains "Log server / fwd process errors," directly confirming it as the correct file for investigating logging issues.

3. Check Point R81.10 Security Management Administration Guide, Chapter "Logging and Monitoring": This guide details the architecture of Check Point logging, identifying the Log Server (which runs the fwd process) as the component on the Security Management Server that receives, parses, and stores logs from Security Gateways. Troubleshooting this component would involve its specific log files.