topic Re: Cluster Failover in Firewall and Security Management

Cluster Failover

ESpataro — Mon, 17 Oct 2022 12:46:20 GMT

Can anyone tell me from the below the reason for this failover ?

Cluster Mode: High Availability (Active Up) with IGMP Membership

ID Unique Address Assigned Load State Name

1 1.1.1.1 0% STANDBY kerberus1
2 (local) 1.1.1.2 100% ACTIVE kerberus2

Active PNOTEs: None

Last member state change event:
Event Code: CLUS-114904
State change: ACTIVE(!) -> ACTIVE
Reason for state change: Reason for ACTIVE! alert has been resolved
Event time: Thu Oct 13 14:48:32 2022

Last cluster failover event:
Transition to new ACTIVE: Member 1 -> Member 2
Reason: Available on member 1
Event time: Thu Oct 13 12:44:14 2022

Cluster failover count:
Failover counter: 16
Time of counter reset: Thu Nov 25 20:44:45 2021 (reboot)

Re: Cluster Failover

ESpataro — Mon, 17 Oct 2022 12:57:50 GMT

Reason: FULLSYNC PNOTE - cpstop message on other cluster member , I have not sure what this means

Re: Cluster Failover

G_W_Albrecht — Mon, 17 Oct 2022 13:00:06 GMT

No - the Event time is clear in 12:44 Failover, 14:48 State Change - better look into the logs !

Re: Cluster Failover

PhoneBoy — Mon, 17 Oct 2022 13:10:34 GMT

I would interpret that to mean someone typed cpstop into the relevant gateway.
Given that stops all Check Point services, it would definitely cause a failover…

Re: Cluster Failover

Alexander_Wilke — Fri, 16 Dec 2022 14:53:53 GMT

Hello,

Check the /var/log/messages and compare the CLUS messages to this sk125152

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk125152

Re: Cluster Failover

the_rock — Fri, 16 Dec 2022 16:42:35 GMT

As @PhoneBoy said, message you gave means someone issued cpstop on the active member, which would have caused the failover, for sure.

Re: Cluster Failover

Alexander_Wilke — Sat, 17 Dec 2022 01:13:31 GMT

The event CLUS-114904 only tells you that it moved from ACTIVE (!) to ACTIVE.

This was at 14:48:32

2hrs BEFORE that event something else happend.
We only know this:
Transition to new ACTIVE: Member 1 -> Member 2

But we do not know the reason for that. To understand the reason like @G_W_Albrecht said you have to look into the logs.