The Check Point logging architecture relies on the FireWall Daemon (fwd) process for log transmission. On a Security Gateway, the fwd process collects logs generated by the firewall kernel and forwards them to the Log Server, which is typically the Security Management Server. This communication for the fw.log service is standardized to occur over TCP port 257. The fwd process on the Security Management Server listens on this port to receive, process, and index the incoming logs from the gateways.

B. The cpm process on port 19009 is used for communication between SmartConsole clients and the Security Management Server, not for log forwarding from a gateway.

C. The fwm process on port 18190 is the primary management process used for tasks like policy installation, not for receiving logs from gateways.

D. The fwm process is incorrect for log forwarding; the fwd process handles this function.

1. Check Point Support Center, SecureKnowledge (SK) Article sk25921: "Ports used for communication by Check Point software". This official document explicitly lists the services, ports, and processes.

Section/Table: Under the "Security Management Server" and "Security Gateway" sections.

Entry: Service Name: fw.log, Port: 257/tcp, Process: fwd.

Description: "Log connection. Used by the Security Gateway to send logs to the Security Management Server / Log Server."

2. Check Point R81.20 Logging and Monitoring Administration Guide: This guide details the architecture of the logging system.

Chapter: "Logging Architecture"

Content: The guide describes the log flow from the Security Gateway kernel to the fwd process, which then sends the logs to the Log Server. It states, "The FWD process on the Security Gateway sends logs to the FWD process on the Log Server." This confirms the role of the fwd process in log transmission.