156-215.81.20 Monitoring and Logging Practice Question
An administrator is troubleshooting why logs from a Security Gateway are not appearing in SmartLog, even though the gateway is configured to send logs to the Management Server and the connection is established. The administrator runs 'cp_log_export' on the Management Server and sees that logs are being exported to an external syslog server successfully. What is the most likely reason for the logs not appearing in SmartLog?
⚠ Common exam trap
The trap here is assuming that successful log export means the logs are also indexed, but indexing is a separate process that can fail independently.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The log indexer service on the Management Server is not running.
The log indexer service is responsible for indexing logs so they can be searched in SmartLog. If it is not running, logs may still be received and exported via 'cp_log_export', but they will not appear in SmartLog. This matches the scenario where logs are present but not visible in SmartLog.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Management Server's disk is full, preventing new logs from being written.
Why it's wrong here
If the disk were full, new logs might not be written, but 'cp_log_export' would likely fail or export only old logs. The scenario states that 'cp_log_export' is working, implying that logs are being written and can be exported. A full disk would typically affect both logging and exporting, so this is less likely than an indexing issue.
- ✗
The Security Gateway's log forwarding configuration is incorrect.
Why it's wrong here
If the gateway's log forwarding were incorrect, logs would not reach the Management Server at all, and 'cp_log_export' would not have logs to export. Since 'cp_log_export' successfully exported logs, the gateway is sending them correctly. Therefore, the issue is not with the gateway's configuration but with the indexing on the Management Server.
- ✗
SmartLog is not licensed on the Management Server.
Why it's wrong here
SmartLog is a core feature included with most Check Point management licenses. If it were not licensed, the administrator would likely see an error or be unable to access SmartLog at all. The scenario implies that SmartLog is accessible but not showing logs, so licensing is not the primary suspect.
- ✓
The log indexer service on the Management Server is not running.
Why this is correct
If the log indexer service is not running, logs may still be received and even exported to external syslog, but they will not be indexed for SmartLog. SmartLog relies on the indexer to make logs searchable. The fact that 'cp_log_export' works confirms that logs are present on the server, but the indexer's failure explains their absence in SmartLog.
About these practice questions
This 156-215.81.20 question is part of Courseiva's 210-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This 156-215.81.20 practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 156-215.81.20 exam.