SmartEvent utilizes the Log Server, Correlation Unit and SmartEvent Server to aggregate logs and identify security events. The three main processes…

The processes listed in option B correspond to the three primary components of the Check Point SmartEvent architecture, particularly in versions preceding R80. These legacy process names are derived from "Eventia," the former name for the product suite.

eventiacu: The Eventia Correlation Unit process, which analyzes logs to identify security events.

eventiasv: The Eventia Server process, which manages the event database and client connections.

eventiarp: The Eventia Reporter process, responsible for generating reports from event data.

While R80 and newer versions use updated process names (cpsemd, cpsead), this option correctly identifies a complete and historically accurate set of three core SmartEvent processes.

A. cplog is a command-line utility for viewing logs, not a primary daemon governing a SmartEvent component. The other names are either outdated or too generic.

C. cpsemd and cpsead are the correct modern SmartEvent processes, but DBSync is a process for database synchronization in a High Availability deployment, not a core SmartEvent component.

D. fwd is the general-purpose log daemon for the Security Management Server, not a process specific to SmartEvent's analysis functions. secu is not a valid Check Point process.

1. Check Point Support Center, SK98722 - Check Point Processes and Daemons: This article lists the key processes for Check Point products. It explicitly identifies eventiaserver (eventiasv), eventiacu (eventiacu), and eventiarp (eventiarp) as the processes for the Eventia Suite/SmartEvent. It also lists the modern cpsemd and cpsead processes, illustrating the naming evolution.

2. Check Point R81.10 Logging and Monitoring Administration Guide, Chapter 3 "SmartEvent," Section "SmartEvent Architecture": This guide describes the modern architecture, identifying the SmartEvent Server and Correlation Unit as the main components. It details the functions that correspond to the modern processes cpsemd and cpsead, which helps invalidate option C as it only contains two of the three required processes.

3. Check Point R81.10 Security Management Administration Guide, Chapter 12 "Management High Availability," Section "The Synchronization Process": This document describes the function of the DBSync process, confirming it is used for synchronizing databases between management servers in a High Availability configuration and is not a core process of the SmartEvent analysis and correlation engine.