topic Re: Local probing messages in Firewall and Security Management

Local probing messages

Roy_Smith — Thu, 04 Nov 2021 10:15:16 GMT

In looking into some performance issues reported by our VPN users, I have noticed the following messages in fwk.elg

[4 Nov 9:45:05][fw4_1];[vs_5];CLUS-120207-2: LPRB PNOTE : local probing has started on interface wrp320
[4 Nov 9:45:06][fw4_1];[vs_5];CLUS-120207-2: LPRB PNOTE : local probing had stopped on interface wrp320

The messages appear in fwk.elg for several of our virtual systems, which include some that do not have VPN enabled and for different interfaces. The messages only seem to appear during the day, when the gateways are under load. They can appear from every minute to 15 minutes apart.

I have looked at sk171844 relating to this sort of message but what it does not make clear, is whether these messages only appear when there is an issue or not. None of the interfaces ever go down and cphaprob syncstat does not show any issues.

Can anyone confirm if these messages are normal and can be ignored? Or they indicative of an underlying issue?

For info, we are running R80.40 with JHF take 118 on a 2-member VSX cluster in VSLS mode.

Many thanks

Roy

Re: Local probing messages

_Val_ — Thu, 04 Nov 2021 10:34:41 GMT

Those messages are related to ClusterXL probing and not to VPN. Local probing means cluster is checking if cluster interface is still alive. It usually happens when there is a network failure on a cluster, but can also be caused by delayed CCP probing under load.

Although harmless by themselves in such a case, those messages maybe a symptom of performance issue with the cluster. Please check /var/log/messages for Cluster Under Load (CUL) entries, around the same time or a bit earlier than PNOTE entries you have mentioned above.

Re: Local probing messages

Roy_Smith — Thu, 04 Nov 2021 11:51:25 GMT

Thanks Val.

I don't see any CUL entries in /var/log/messages. I am leaning towards the cluster or gateway being under load but there does not appear to be anything obvious. Whenever I run cphaprob if, all interfaces are UP.

When is local probing initiated? Or is it running continuously?

Thanks
Roy

Re: Local probing messages

_Val_ — Thu, 04 Nov 2021 12:39:07 GMT

CCP is issuing 3 packets per second on monitored interfaces, to make sure all connectivity is up. If one of the packet does not arrive or is not processed in time, probing process starts.

cphaprob only shows things that are defined as failed, after the probing failed. I would look into core assignment, and into core load history.