topic Push Operations in Endpoint

Push Operations

CP-Shark — Thu, 03 Nov 2022 14:39:44 GMT

Hi guys,

I am wondering if it is possible to create a custom Push Operation for starting blades. In some cases blades are not running and I thought the possibility of a push operation could be solution !?!?

Any ideas or how do you handle these kinds of issues?

KR,
Oliver

Re: Push Operations

Swiftyyyy — Thu, 03 Nov 2022 14:51:04 GMT

Generally the Check Point watchdog service should handle automatically restarting blades assuming they're for whichever reason in a stopped state.
If the watchdog isn't restarting the service then there's a deeper issue that should be examined.

Unless of course you're permitting users to disable blades in the client UI. In which case, that's a policy issue.
(Though on the topic of that, I would love a push operation or policy or whatever which allows me to disable blades for a limited time instead of having to keep track of things manually)

Re: Push Operations

CP-Shark — Thu, 03 Nov 2022 14:59:02 GMT

If the watchdog isn't restarting the service then there's a deeper issue that should be examined.

Any ideas, SKs or hints how to troubleshoot this issue deeper?

Re: Push Operations

Swiftyyyy — Thu, 03 Nov 2022 15:01:28 GMT

It depends on the blade really.
In general though, I'd give clients a bit of time to sort things out by themselves.

Quite often you'd encounter cases where a client comes online & does the first communication interval before a blade has the chance to fully initialize. Then you end up with a falsely reported state on your dashboard for a little while.

The persistent cases lasting more than a few hours should be looked at though.

Re: Push Operations

CP-Shark — Thu, 03 Nov 2022 15:19:07 GMT

This behaviour is quite common and I know this. But we have a few clients where the persistent cases definitly lasting more than a few hours and we are very keen for the understanding of these issues.

Re: Push Operations

PhoneBoy — Thu, 03 Nov 2022 18:14:19 GMT

Again, it depends on what the situation is.
TAC should be involved in these cases.