topic Re: Policy install duration in Firewall and Security Management

Policy install duration

Simon_Macpherso — Fri, 12 Feb 2021 05:21:52 GMT

Hi all,

How do you check the policy installation duration?

Regards,

Simon

Re: Policy install duration

PhoneBoy — Fri, 12 Feb 2021 06:29:41 GMT

You mean how long the policy install is taking?
I don’t believe we instrument it, or if we do, we don’t expose that anywhere.

Re: Policy install duration

Chris_Atkinson — Fri, 12 Feb 2021 06:32:01 GMT

In the bottom left hand corner of SmartConsole you have the "Tasks" section to view progress/status etc

The "Details" option should provide you more info including the Start & Completion Time.

Re: Policy install duration

Timothy_Hall — Fri, 12 Feb 2021 14:14:01 GMT

On an R80+ SMS all policy install events are logged to a special file $FWDIR/log/install_policy.elg with timestamps. In particular try seeking out **##PERF_MSG_IDENTIFY##** records in that file, as they appear to have the duration information you need, but it is not exactly easy reading:

**##PERF_MSG_IDENTIFY##** {"duration_data":[{"duration":0.4473197529999826,"name":"duration_of_code_generation#A-GW-Cluster"},{"duration":4.560813636999992,"name":"duration_of_policy_commit#A-GW-Cluster"},{"duration":0.9066284540000029,"name":"duration_of_policy_compilation#A-GW-Cluster"},{"duration":0.7535922519999899,"name":"duration_of_policy_transfer#A-GW-Cluster"}]}&CURRENTVERCMP

Re: Policy install duration

the_rock — Fri, 12 Feb 2021 18:43:08 GMT

What Chris said is pretty much the only way I know...you can see the percentage mind you, not the time itself, so technically, there is really no way to know how much time had elapsed since the policy install began. But, thats something that sounds like a nice feature CP could add in the future.

Re: Policy install duration

Timothy_Hall — Sat, 13 Feb 2021 23:02:56 GMT

Hi @Chris_Atkinson it would be helpful if the granularity of the times displayed at the start and end of a policy installation in the Tasks area of SmartConsole could be increased to show not just the hour and minute but also seconds as well. Thanks!

Re: Policy install duration

Chris_Atkinson — Wed, 17 Feb 2021 00:45:20 GMT

The use case might be diminished now with accelerated policy install in R81 (sk169096) but thanks for the feedback I'll pass it along.

/Edit: Now available with R81 SmartConsole Build 549 and above:

Re: Policy install duration

the_rock — Sun, 14 Feb 2021 01:27:37 GMT

I am pretty positive that sk is 99% wrong...I seen it before and tested in R81 lab and literally none of those things apply. Not sure who from Check Point came up with that list, but I would be curious to know exactly what type of testing they did : )

Re: Policy install duration

Chris_Atkinson — Sun, 14 Feb 2021 01:42:44 GMT

Requires management & gateway to be R81, was that the case in your lab?

Re: Policy install duration

the_rock — Sun, 14 Feb 2021 01:45:16 GMT

Exactly that! And I know you guys like to always ask people to install latest jumbo, so I did...jumbo 13. Makes no difference. Try it yourself and you will see.

Re: Policy install duration

Chris_Atkinson — Sun, 14 Feb 2021 02:07:24 GMT

What was the specific symptom, the policy failed to install or just took longer than you expected to complete?

Perhaps some testing with and without it disabled (sk168055) is needed to quantify further.

@Eran_Habad

Re: Policy install duration

the_rock — Sun, 14 Feb 2021 02:13:18 GMT

For 7 rules, it takes almost 3 minutes, which is ridiculous : ). I did all my testing, you work for CP, so you are welcome to test it yourself.

Re: Policy install duration

Chris_Atkinson — Wed, 17 Feb 2021 00:52:27 GMT

All applicable policy install operations are completing well within a minute or less in my R81 lab.

Test 1: Adding new rules.

Test 2: Adding new services to existing rules.

Re: Policy install duration

the_rock — Sun, 14 Feb 2021 03:29:17 GMT

Maybe mine is "broken" due to the fact I followed script to fix geo policy being hidden in R81. I will clean install it tomorrow and see what happens.

Andy

Re: Policy install duration

Chris_Atkinson — Sun, 14 Feb 2021 04:37:34 GMT

Try testing without the Geo objects if used.

Not seeing those or Updatable objects listed in sk169096 as qualifying for accelerated policy install as yet.

Re: Policy install duration

PhoneBoy — Sun, 14 Feb 2021 07:08:54 GMT

Keep in mind Accelerated Policy Install will not accelerate all policy installs.
The first install of a newly created policy will take longer for sure.
However, subsequent changes to said policy should be much faster (assuming they are as described in sk169096).

Re: Policy install duration

the_rock — Sun, 14 Feb 2021 15:18:39 GMT

Ok, so here is what I did...did reinstall of R81 on my standalone lab config and that seemed to fix it. I created 10 rules, few of them geo policy, and it takes 35 seconds to install, so I think its working fine! Thanks guys.

Re: Policy install duration

Simon_Macpherso — Mon, 15 Feb 2021 03:08:00 GMT

Thanks @Timothy_Hall

That is the file I was looking for but couldn't recall it's name and location.

Regards,

Simon

Re: Policy install duration

Tomer_Noy — Mon, 15 Feb 2021 11:46:08 GMT

Thanks Tim.

We actually had the same idea, because we wanted to "show off" how many seconds the accelerated policy installation took. In the upcoming SmartConsole update for R81, we changed the task information for policy installation tasks to show the seconds as well 😀

In general, if you want to see if your policy installation was accelerated, look at the icon. If there's a small lightning there, then it was accelerated. If not, then you can hover over it to see the reason that it wasn't accelerated.

Last, remember that the gateway is also doing some processing during policy installation. This was greatly optimized with the accelerated installation flow, but a heavily loaded gateway may still take longer than a reasonably loaded one.