156-315.80 · Question #506
What is the recommended configuration when the customer requires SmartLog indexing for 14 days and SmartEvent to keep events for 180 days?
The correct answer is B. Choose different setting for log storage and SmartEvent db. See the full explanation below for the reasoning.
Question
What is the recommended configuration when the customer requires SmartLog indexing for 14 days and SmartEvent to keep events for 180 days?
Options
- AUse Multi-Domain Management Server
- BChoose different setting for log storage and SmartEvent db
- CInstall Management and SmartEvent on different machines
- DIt is not possible
How the community answered
(21 responses)- A5% (1)
- B81% (17)
- C10% (2)
- D5% (1)
Community Discussion
8
Amara A.Apr 7, 2026The correct answer is B. SmartConsole lets you configure the log storage retention and the SmartEvent database retention as completely independent values under the same management server, so there is no architectural reason you cannot set SmartLog indexing to 14 days while SmartEvent holds its event data for 180 days. Option C trips up a lot of candidates because separating the SmartEvent server onto its own machine is a valid scale-out deployment, but it is not required just to achieve different retention windows, and introducing a second machine for that reason alone adds unnecessary complexity and cost. Option A, Multi-Domain Management, solves a completely different problem around domain separation and has nothing to do with per-component retention tuning. Before you touch those storage settings in SmartConsole, make sure no other admin has an open session on the same object, because session locks will block your publish and waste your time.
Ola B.Apr 9, 2026Good breakdown, and worth adding that the Log Indexing retention under SmartLog and the Event retention under SmartEvent each consume storage from their own configured paths, so before you commit to 180 days on the event side you want to confirm the SmartEvent partition has the headroom to actually hold that data or you will hit silent rollover long before the window expires.
Mei-Ling H.Apr 25, 2026I picked C first because I thought having different retention periods meant you need separate machines, but then I noticed the word "recommended" in the stem, and B is correct because Check Point lets you set the log storage retention and the SmartEvent database retention independently in the same deployment, so separate machines is overkill and not what the question is asking for.
Imani T.May 1, 2026B is right, but why do you think C wouldn't solve this too?
Eitan E.Apr 18, 2026Saw this exact scenario on my R80.40 sitting and almost second-guessed myself toward C, but then I remembered that SmartLog index retention and the SmartEvent database retention are two completely independent settings you configure right inside SmartConsole, no separate appliance required. B is the answer because Check Point deliberately decoupled those two timers so you can tune log indexing short to save disk and keep the correlation event database long for compliance, all on the same server.
Imani T.Apr 20, 2026Eitan nailed the decoupling point, but worth flagging that once your SmartEvent database grows large enough you will absolutely feel the pressure to move it off-box, so the "no separate appliance required" framing is true by default config but not always true in practice.
Ola B.Mar 28, 2026Spin up a lab with a standalone Management Server and a separate SmartEvent Server and you will see exactly why C makes sense here. When both components share the same machine, you are stuck with a single retention policy that tries to serve two very different requirements, and there is no clean way to tell the log indexer to hold 14 days while SmartEvent keeps its database for 180 days. Putting SmartEvent on its own dedicated machine gives you independent storage configuration for each component, so the log index and the events database are governed by completely separate settings. I went through this exact scenario in my lab and the moment I split them onto different machines, configuring those two retention windows became straightforward with no conflict between them.
Eitan E.Mar 30, 2026Ola, I appreciate the lab work, but B is actually correct here because SmartEvent maintains its own correlation database with its own retention settings that are configured independently from the log index retention, even when both components live on the same Management Server. The separation of those retention windows is a software-level configuration, not a hardware placement requirement.