Splunk Enterprise Security

Error regarding Checkpoint OPSEC LEA

kartreddy4
New Member

I have installed the splunk Add-on on the Heavyforwarders and when trying to establishing the connection over TCP 18184 and hitting on save, its throwing up this error

External handler failed with code '1' and output: 'REST ERROR[400]: Bad Request - GNU C library (glibc.i686 32-bit and pam.i686) is missing.'. See splunkd.log for stderr output.

  1. Do i need to install the 32bit lib files as requirement ?

  2. Is configuring add-on, on the heavyfowarders the recommended way?

  3. The checkpoint servers in my company are very outdated currently running major version R70 but the minimum requirement in splunk is R76 ? will it still work when configured. Please help

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

(1) Yes, or at least in the older versions you did
(2) Yes
(3) No idea, you might have to test it and see but I suspect Splunk support would be "best effort" if your using an incompatible version of the firewall logging server!

View solution in original post

0 Karma

jchapell
Explorer

@gjanders is right, you will need the libraries installed, configuring on the heavy forwarder is the desired method, and as for working with r70, if you can find an older version of the app, it may work. I would personally look into upgrading my checkpoint instances to r80.10. I just moved ours from r77.30 to r80.10 and couldn't be happier with them after working out some kinks.

0 Karma

gjanders
SplunkTrust
SplunkTrust

(1) Yes, or at least in the older versions you did
(2) Yes
(3) No idea, you might have to test it and see but I suspect Splunk support would be "best effort" if your using an incompatible version of the firewall logging server!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...