https://community.checkpoint.com/t5/Firewall-and-Security-Management/Weird-issue-due-to-pentest/m-p/185824#M34175 <P>Did you check /var/log/messages or anything like that?<BR />Maybe there was significant load on the Apache running the Gaia WebUI and/or multiportal.</P> Thu, 06 Jul 2023 15:56:41 GMT PhoneBoy 2023-07-06T15:56:41Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Weird-issue-due-to-pentest/m-p/185787#M34164 <P>I am investigating an issue with a side effect of the pentest on a firewall.</P> <P>The implied rules allow HTTPS to the gateway. The pentester has used it to run some test (yet unspecified) against the gateway.</P> <P>The customer complaind it had a heavy impact on their business. But looking at it afterthe fact I could not find anything odd in $FWDIR/log/*elg* nor $CPDIR/log/*elg* files. Neither was cpview -t showing anything out of the ordinary. Just a slight increase of the load on the FW worker CPU's.</P> <P>So far the only thing that I found interesting is that with 8 cores I only have 4 FW workers. Where the 4 SDN cores are almost 99% idle.&nbsp;</P> <P>Anyone any other suggestion to investigate over 24 hours after the fact?</P> Thu, 06 Jul 2023 12:41:32 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Weird-issue-due-to-pentest/m-p/185787#M34164 Hugo_vd_Kooij 2023-07-06T12:41:32Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Weird-issue-due-to-pentest/m-p/185824#M34175 <P>Did you check /var/log/messages or anything like that?<BR />Maybe there was significant load on the Apache running the Gaia WebUI and/or multiportal.</P> Thu, 06 Jul 2023 15:56:41 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Weird-issue-due-to-pentest/m-p/185824#M34175 PhoneBoy 2023-07-06T15:56:41Z