topic Re: Identify Appliances CP crashes in General Topics

Identify Appliances CP crashes

Matlu — Fri, 27 Oct 2023 05:17:41 GMT

Hello, Mates.

Which files are recommended to check, for example in a SMS, Smart Event, or GW (Appliances), when you have a "crash" or "reboot" of one of these equipments, in an "unexpected" moment?

We want to identify why some equipment "crashed" (SMS and Smart Event), maybe because of a software problem of the equipment (high CPU or memory consumption), or some additional cause.

Are there files that allow us to have a vision of what could have happened, without resorting to the TAC?

Thanks for your comments.

Re: Identify Appliances CP crashes

PhoneBoy — Fri, 27 Oct 2023 16:32:44 GMT

cpview captures a lot of historical data that can be used to view the system at specific points of time.
HealthCheck Point can also provide a timeline report with critical events: https://support.checkpoint.com/results/sk/sk171436

Beyond that, you're looking into various logs (/var/log/messages, $FWDIR/log/*.elg).
Any core files you find can only be analyzed by TAC, but the fact they exist indicate an issue.

Re: Identify Appliances CP crashes

the_rock — Sat, 28 Oct 2023 15:06:54 GMT

You can check /var/log/crash and /var/log/dump/usermode directories. Also, you can run cpview -s export command and it will tell you where zip file is located, so you can export the file and review it offline.

Cheers,

Andy

Re: Identify Appliances CP crashes

Bob_Zimmerman — Sat, 28 Oct 2023 15:57:02 GMT

Certain kernel faults will cause a reboot. They generally try to produce a core dump first, but this isn't always possible. If you get a core dump, only the TAC (or really, CFG) will have the debug symbols needed to tell what happened.

Other than that, almost all spontaneous reboots are caused by hardware faults. For example, if you have bad power or if your power supply is faulty, high processor usage can draw more power than the power supply can provide without voltage droop, also known as a brownout. This won't leave any logs or indication of the cause of the problem in the OS. A good LOM will log a brownout or most other hardware faults. Check Point's branded boxes do not have good LOM.

High resource consumption will never cause a reboot directly.