You tested the connection from source to destination and you are not able to find logs in your Security Management. What is the best possible reason?

In Check Point's architecture, a Security Gateway's capabilities are enabled through Software Blades configured in SmartConsole. For a gateway to generate and forward traffic logs to the Security Management Server, the "Logging & Status" blade must be explicitly enabled on that gateway's object. If this blade is not enabled, the gateway will still enforce the security policy (allow/drop traffic) but will not perform the logging function. Therefore, the absence of this fundamental configuration is the most direct and likely reason for not finding logs on the management server after a connection test.

A. The FWM process on the Security Management server handles management tasks (e.g., GUI client connections, policy installation), not log reception. The FWD process is responsible for receiving logs.
B. Insufficient storage would likely impact all logging from all gateways and generate system health alerts. It is a less specific reason than a configuration issue for a single gateway.
D. While configuring the gateway to log only locally would produce the same symptom, enabling the logging blade is the prerequisite for any logging activity, making it a more fundamental cause.

1. Check Point R81.20 Security Management Administration Guide:

Page 100, "Configuring a Security Gateway to send Logs": The guide explicitly states: "To enable a Security Gateway to send logs to a Log Server or Security Management Server: 1. In SmartConsole, open the Security Gateway object. 2. On the General Properties page, in the Network Security tab, select Logging & Status." This confirms that enabling the blade is a required step.

2. Check Point Support Center, SecureKnowledge (SK) Article sk170516, "Check Point Processes and Daemons":

Section "fwm": Describes FWM as "The main process of the Security Management Server... responsible for... Policy installation... Communication with the GUI clients".

Section "fwd": Describes FWD as the process responsible for "...Logging (pulling logs from other Check Point modules and sending them to the Log Server)...". This documentation confirms that option A cites the incorrect process for logging.

3. Check Point R81.20 Logging and Monitoring Administration Guide:

Chapter 2, "Logging", Section "Log Management": This section details procedures for handling low disk space on a Log Server, which includes issuing alerts and pre-defined actions. This supports the reasoning that a storage issue (Option B) would be a visible system-wide event, not a silent failure for a specific test.