Identity Awareness daemon status

cyberluke365 — Fri, 22 Nov 2024 15:43:47 GMT

Hello,

I have two CheckPoint R81.20 Security Gateways with Take 53 and Identity Awareness blade enabled (just the Identity Collector as source):

All is working fine; however, I was trying to figure out how to check Identity Awareness service/daemon status.

According to sk97638 - Check Point Processes and Daemons the cpwd_admin list | grep -E "APP|PEPD" and cpwd_admin list | grep -E "APP|PDPD" should be used to see the status of Policy Enforcement Point daemon and Policy Decision Point daemon respectively.

The output of the two commands run on the Security Gateways returns nothing. It appears that the PEPD and PDPD processes are not running.

However, if I run the command ps -ef | grep -E "pdpd|pepd", it returns:

xxxxx 30559 28679 2 Jun03 ? 3-13:23:29 pdpd 0 -t xxxxx 30560 28679 0 Jun03 ? 00:45:30 pepd 0 -t

So, that means they are really running (as written, all is working fine) but they appear as child processes of the parent PID 28679 (that belongs to FWD daemon).

Is that a normal behavior? Perhaps the information provided in the SK needs to be interpreted in a specific way?

Thank you.

Re: Identity Awareness daemon status

the_rock — Fri, 22 Nov 2024 16:22:37 GMT

I always found that info to be a bit deceiving, at least for pep/pdp. I check it with below commands from expert.

Andy

pdp status show

pep show stat

Re: Identity Awareness daemon status

the_rock — Tue, 26 Nov 2024 11:49:17 GMT

@cyberluke365 Hope that helped?

Andy

topic Re: Identity Awareness daemon status in Firewall and Security Management

Identity Awareness daemon status

Re: Identity Awareness daemon status

Re: Identity Awareness daemon status