topic Re: System Incidents Report in General Topics

System Incidents Report

prasanga — Mon, 30 Aug 2021 06:00:01 GMT

Where can i view or get a report of system related incidents happened in the firewall giving a time period ?

Ex : HA failovers / Interface up-down incidents / Hardware level issues happened

regards,

Prasanga

Re: System Incidents Report

796570686578 — Mon, 30 Aug 2021 06:47:07 GMT

HA Failovers you can see with the command "cphaprob show_failover". Not sure about Interface statuses but they are usually logged in /var/log/messages as far as I know.

Re: System Incidents Report

Tal_Paz-Fridman — Mon, 30 Aug 2021 08:42:49 GMT

Use the cpview command which contains an infinite amount of information about the gateway:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101878

It also has a history mode (cpview -t) to see historical values and incidents.

HTH

Tal

Re: System Incidents Report

Timothy_Hall — Mon, 30 Aug 2021 11:49:28 GMT

Try this log filter in the SmartConsole: origin:gwname AND type:Control

You must capitalize "Control" for that filter to work. If the gateway is using ClusterXL those logs will show interface failures detected by CCP, however some system events only appear in /var/log/messages unless you do this: sk102995: How to export syslog messages from Gaia Security Gateway to a Log Server and view them in SmartView Tracker

Re: System Incidents Report

Tal_Paz-Fridman — Mon, 30 Aug 2021 12:34:14 GMT

Hi, this was just published if you're interested in learning more about CPview - CPview and DiagnosticsView TechTalk: Video, Q&A, and Slides

https://community.checkpoint.com/t5/Security-Gateways/CPview-and-DiagnosticsView-TechTalk-Video-Q-amp-A-and-Slides/m-p/127893#M18580

Re: System Incidents Report

Ruan_Kotze — Mon, 30 Aug 2021 13:18:43 GMT

Surprised this has not been mentioned yet, but check out HealthCheck Point.

Re: System Incidents Report

prasanga — Wed, 01 Sep 2021 09:33:20 GMT

Found a place to view these in "SmartView".

Can filter by Type - "System Alert" and Blade- "Firewal".

Thanks all for the responses.