Check Point Live Patch (CPLP)

David_Evans — Wed, 09 Sep 2026 13:49:09 GMT

Has anyone written a custom metric yet for Check Point Live Patch (CPLP) ?

Or anyone have any inside information into a built in metric coming "soon" before I spend a few hours writing one?

Re: Check Point Live Patch (CPLP)

Bob_Zimmerman — Wed, 09 Sep 2026 16:10:26 GMT

I'm working on one right now, after discovering a lot of my firewalls don't actually have CPLP yet.

Re: Check Point Live Patch (CPLP)

Duane_Toler — Wed, 09 Sep 2026 20:18:23 GMT

This should help:

# cplp list --json |jq -r '.|length' 77 # cplp list --json |jq -r '.[0] |keys' [ "active", "addr_hex", "all_pids", "anchor", "applied_at", "applied_by", "arch", "audit", "auto_select", "comm", "comment", "cover", "cover_detail", "cover_kind", "cover_reason", "cover_token", "fix_prefix", "host", "id", "lib_basename", "lib_path", "mode", "n_pids_armed", "n_pids_reverted", "n_pids_total", "name", "patch_id", "patches_dir", "pids", "proc_name", "status", "symbol", "unresolved", "unsupported", "unsupported_reason" ]

# cplp list --json |jq -r '.[0] ' { "active": true, "addr_hex": null, "all_pids": [ 23796 ], "anchor": null, "applied_at": "2026-07-30T13:30:01Z", "applied_by": "admin", "arch": "i386", "audit": true, "auto_select": true, "comm": "cpca", "comment": "sk185152", "cover": "ok", "cover_detail": null, "cover_kind": null, "cover_reason": "x86 GA branch jaguar_main has no own patch; fell back to jumbo R82_jumbo_hf_main earliest build 998000024 -> libcpca_R82_jumbo_hf_main_998000024.so", "cover_token": null, "fix_prefix": "libcpca", "host": "bayou", "id": "cpca:cpca:3304b2df72", "lib_basename": "libcpca.so", "lib_path": "/opt/CPshrd-R82/lib/libcpca.so", "mode": "livepatch", "n_pids_armed": 1, "n_pids_reverted": 0, "n_pids_total": 1, "name": "cpca", "patch_id": "cpca:cpca:3304b2df72", "patches_dir": "/opt/cplp/patches", "pids": [ 23796 ], "proc_name": "cpca", "status": "armed", "symbol": "fwcaHandShakerS::CheckConfig", "unresolved": false, "unsupported": false, "unsupported_reason": null }

# cplp list --json |jq -r '. |map(select(.comment|contains("CVE-2026-85103"))) |length' 30 # cplp list --json |jq -r '.[]|select(.comment|contains("CVE-2026-85103"))' # ... { "active": true, "addr_hex": null, "all_pids": [ 10485, 9793, 10583, 10055, 10188, 10356, 9932, 9621, 9857, 9651, 9710, 9614, 9610, 9606 ], "anchor": null, "applied_at": "2026-09-09T13:12:40Z", "applied_by": "admin", "arch": "i386", "audit": true, "auto_select": true, "comm": "wstlsd", "comment": "CVE-2026-85102 CVE-2026-85103", "cover": "ok", "cover_detail": null, "cover_kind": null, "cover_reason": "x86 jumbo branch R82_jumbo_hf_main build 998000024 is below the earliest jumbo patch build 998000028; no GA baseline installed, so the earliest jumbo build takes ownership -> libcpcert_R82_jumbo_hf_main_998000028.so", "cover_token": null, "fix_prefix": "libcpcert", "host": "bayou", "id": "cpcert:wstlsd:a6ec397432", "lib_basename": "libcpcert.so", "lib_path": "/opt/CPshrd-R82/lib/libcpcert.so", "mode": "livepatch", "n_pids_armed": 14, "n_pids_reverted": 0, "n_pids_total": 14, "name": "cpcert", "patch_id": "cpcert:wstlsd:a6ec397432", "patches_dir": "/opt/cplp/patches/cpcert_2", "pids": [ 10485, 9793, 10583, 10055, 10188, 10356, 9932, 9621, 9857, 9651, 9710, 9614, 9610, 9606 ], "proc_name": "wstlsd", "status": "armed", "symbol": "fwAsnBits::Concat", "unresolved": false, "unsupported": false, "unsupported_reason": null } #... '

# cplp status --all --json |jq -r '. |length' 77 # cplp status --all --json |jq -r '.[1] |keys' [ "addr_hex", "anchor", "arch", "comm", "label", "lib_path", "manifest_status", "mode", "name", "patch_id", "proc_name", "results", "source_file", "symbol" ] # cplp status --all --json |jq -r '.[42]' { "addr_hex": null, "anchor": null, "arch": "i386", "comm": "wstlsd", "label": "fwAsnBits::Concat", "lib_path": "/opt/CPshrd-R82/lib/libcpcert.so", "manifest_status": "armed", "mode": "livepatch", "name": "cpcert", "patch_id": "cpcert:wstlsd:a6ec397432", "proc_name": "wstlsd", "results": [ { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "68509a13f7c3", "observed_status": "armed_clean", "pid": 10485, "reason": null, "runtime_addr_hex": "0xf775ed80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "68501a17f7c3", "observed_status": "armed_clean", "pid": 9793, "reason": null, "runtime_addr_hex": "0xf7796d80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "6850fa10f7c3", "observed_status": "armed_clean", "pid": 10583, "reason": null, "runtime_addr_hex": "0xf7734d80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "6850ea1af7c3", "observed_status": "armed_clean", "pid": 10055, "reason": null, "runtime_addr_hex": "0xf77d3d80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "68501a14f7c3", "observed_status": "armed_clean", "pid": 10188, "reason": null, "runtime_addr_hex": "0xf7766d80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "68507a18f7c3", "observed_status": "armed_clean", "pid": 10356, "reason": null, "runtime_addr_hex": "0xf77acd80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "68507a19f7c3", "observed_status": "armed_clean", "pid": 9932, "reason": null, "runtime_addr_hex": "0xf77bcd80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "68509a10f7c3", "observed_status": "armed_clean", "pid": 9621, "reason": null, "runtime_addr_hex": "0xf772ed80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "6850fa11f7c3", "observed_status": "armed_clean", "pid": 9857, "reason": null, "runtime_addr_hex": "0xf7744d80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "6850ca11f7c3", "observed_status": "armed_clean", "pid": 9651, "reason": null, "runtime_addr_hex": "0xf7741d80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "6850aa1af7c3", "observed_status": "armed_clean", "pid": 9710, "reason": null, "runtime_addr_hex": "0xf77cfd80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "6850aa13f7c3", "observed_status": "armed_clean", "pid": 9614, "reason": null, "runtime_addr_hex": "0xf775fd80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "6850aa19f7c3", "observed_status": "armed_clean", "pid": 9610, "reason": null, "runtime_addr_hex": "0xf77bfd80", "window_len": 6 }, { "action_at": "2026-09-09T13:12:40Z", "comm": "wstlsd", "exec_name": "wstlsd", "expected_state": "armed", "observed_bytes_hex": "68509a13f7c3", "observed_status": "armed_clean", "pid": 9606, "reason": null, "runtime_addr_hex": "0xf775ed80", "window_len": 6 } ], "source_file": "/opt/cplp/patches/cpcert_2/cpcert_patch.json", "symbol": "fwAsnBits::Concat" }

topic Re: Check Point Live Patch (CPLP) in OpenTelemetry/Skyline

Check Point Live Patch (CPLP)

Re: Check Point Live Patch (CPLP)

Re: Check Point Live Patch (CPLP)