topic Re: zdebug command in Firewall and Security Management

zdebug command

Leandro_K — Thu, 01 Sep 2022 06:56:05 GMT

Hi,

I was running the following debug command "fw ctl zdebug + all | grep <ip address>", the command ran for +- 1 minute while I was testing connectivity. I received the following message "fwkdebug: buffer full. messages lost." Where after the gateway dropped all connections and no traffic could pass via the gateway. I could still access the gateway via SSH and Gaia but no networks behind the gateway was able to operate. I had to reboot the gateway to restore operations.

Is there a better way for using the zdebug command and is it recommended for use in a Production environment?

The gateway is a 7000 appliance

Thanks

Re: zdebug command

G_W_Albrecht — Thu, 01 Sep 2022 08:06:22 GMT

See both of this discussions: Tcpdump + Zdebug and https://community.checkpoint.com/t5/General-Topics/fw-ctl-zdebug-this-is-wrong/m-p/9690?search-action-id=48914561403&search-result-uid=9690

Re: zdebug command

Tal_Paz-Fridman — Thu, 01 Sep 2022 08:32:43 GMT

Try running the fw ctl debug command instead.

Look at sk98799 or sk171943 for advanced fw ctl debug features (for example larger buffer)

Re: zdebug command

PhoneBoy — Thu, 01 Sep 2022 16:05:20 GMT

fw ctl zdebug is a "macro" of various fw ctl debug commands that is not applicable in all situations.
It will also generate a lot of debug in a large production environment.

It is far better to do much more targeted debug commands depending on the precise nature of the issue you're trying to track down.
The SKs that @Tal_Paz-Fridman pointed you at will help you craft those commands.
In general, it is advisable to execute the various debug commands during maintenance windows when possible.

Re: zdebug command

Dario_Perez — Thu, 01 Sep 2022 20:43:25 GMT

you are runing debug with all flag enable, keep in mind that is really heavy.

you need to run specific flag. but even with some flag debug can be really heavy.

I suggest create a Ticket and leave TAC leading this