156-215.80 · Question #417
Choose what BEST describes the reason why querying logs now is very fast.
The correct answer is B. Indexing Engine indexes logs for faster search results. Check Point's Indexing Engine pre-indexes log data as it arrives, enabling near-instant query and search results on stored logs.
Question
Choose what BEST describes the reason why querying logs now is very fast.
Options
- ANew Smart-1 appliances double the physical memory install
- BIndexing Engine indexes logs for faster search results
- CSmartConsole now queries results directly from the Security Gateway
- DThe amount of logs been store is less than the usual in older versions
How the community answered
(22 responses)- A9% (2)
- B86% (19)
- D5% (1)
Why each option
Check Point's Indexing Engine pre-indexes log data as it arrives, enabling near-instant query and search results on stored logs.
Increased physical memory improves overall system throughput but is not the architectural mechanism responsible for fast log query performance; indexing provides the fundamental speed improvement.
The Check Point Indexing Engine, integral to SmartLog and SmartEvent, creates structured indexes of log fields in real time as logs are ingested. This means queries resolve against pre-built indexes rather than performing sequential full-file scans, dramatically reducing search time regardless of log volume.
SmartConsole retrieves log data from the Management Server or dedicated Log Server, not directly from the Security Gateway, which does not store indexed query-ready logs.
Reducing stored log volume would offer only marginal speed gains and is neither a design goal nor the mechanism that makes log queries fast in Check Point's logging architecture.
Concept tested: Check Point Indexing Engine accelerating log search
Source: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_LoggingAndMonitoring_AdminGuide/Content/Topics-LMG/SmartLog-Overview.htm
Topics
Community Discussion
No community discussion yet for this question.