topic Disk uage when debugging in Firewall and Security Management

Disk uage when debugging

Marc0523 — Mon, 30 Sep 2024 13:01:32 GMT

Our VPN to AWS died. The AWS logs state Check Point's side stopped responding to DPD requests.
Our logs don't mention this, so I want to turn on debugging to detect this next time it happens.

I want to run

vpn debug trunc ike debug trunc

The issue is, this is a rare problem (only happened once so far), and I am worried about filling up the disk with excessive logs if I have debugs running for days or weeks.

I looked through the documentation, but could not find anything stating how the debug commands make sure they don't fill up the local disk.

Can anyone advise if logging will fill up the disk, or does it automatically delete old logs?
What about CPU usage, do I need to worry about this as well?

Thanks in advance for answers.

Re: Disk uage when debugging

the_rock — Mon, 30 Sep 2024 13:16:58 GMT

This debug is light, you can leave it for days...

Andy

******

vpn debug trunc

vpn debug ikeon

-replicate the issue

vpn debug ikeoff

Or, if you wish to leave it, dont run vpn debug ikeoff (only when you want to turn it off)

To totally turn off debugs, rune fw ctl debug -x; fw ctl debug 0

Re: Disk uage when debugging

Tal_Paz-Fridman — Mon, 30 Sep 2024 13:38:57 GMT

Try running it for ten minutes or an hour to see how much space it takes and calculate what it might take for 24 hours.

Re: Disk uage when debugging

Marc0523 — Mon, 30 Sep 2024 13:55:17 GMT

Issue is we are not sure what caused the issue, so cannot replicate yet.

We might need the debugs running for days or weeks.

I will run the debug on another site which is less important for a day or so, see how big the logs get, and extrapolate how long I can run it on our primary site.

I would feel much more comfortable if I knew it would keep logs files to no greater than xGB.

Re: Disk uage when debugging

the_rock — Mon, 30 Sep 2024 13:56:53 GMT

Thats fair. I can tell you from my personal experience, I had many clients run that debug for week or more, file was NEVER larger than 200 MBs.

Andy