topic Re: ClusterXL under freeze by policy installation in General Topics

ClusterXL under freeze by policy installation

R89_99 — Fri, 06 Apr 2018 14:31:48 GMT

A typical issue is ClusterXL under freeze by policy installation. ClusterXL administrator would like to suppress the messages printed by the Cluster Under Load (CUL) mechanism (see sk92723) in the /var/log/messages file and in the dmesg. I always enable this on the cluster to solve this "under freeze" issue.

1) Open vi and add the following settings

# vi $FWDIR/boot/modules/fwkern.conf

add the Line:

fwha_freeze_state_machine_timeout=0

2) Reboot all Gateways

Re: ClusterXL under freeze by policy installation

Rolf_Kaschek — Fri, 06 Apr 2018 15:08:20 GMT

Is this setting permanet after a reboot?

Re: ClusterXL under freeze by policy installation

R89_99 — Fri, 06 Apr 2018 15:31:14 GMT

If you add lines in fwkern.conf, it is permanent after a reboot.

Regards

Heiko

Re: ClusterXL under freeze by policy installation

SriNarasimha005 — Sat, 07 Apr 2018 17:25:29 GMT

Hi Heiko, Thanks for the great stuff. On doing some research , I did noticed below (sk106576). I'm confused about the statement : "Cluster members do not install policy at the same exact time, and are not aware when the peer members install policy."

Typically, policies are installed @ same time in Clusters. Does this happen under High Load or CPU utilization. Not sure, please assist

Re: ClusterXL under freeze by policy installation

R89_99 — Sat, 07 Apr 2018 18:07:30 GMT

Hi Srinivasan,

over 80% cpu load and 30 sec.

Typical by policy installation.

Regards

Heiko

Re: ClusterXL under freeze by policy installation

Alexander_Wilke — Mon, 30 Jul 2018 11:12:44 GMT

Hello everybody,

we are having a Cluster of 12600 appliances, having a policy with 800 rules and only very very less traffic (< 100Mbit/s, 5000 concurrent Connections) and very less CPU load.

in the beginning we had 200s configured, then we noticed that secondary was going down when doing policy install. We opened a ticket and Support suggested us to increase timeout.

So we increased from 200 - 300s and then a week later from 300 to 600. Did not solve the Problem.

We did not reboot but we did "fw ctl set int fwha_freeze_state_machine_timeout" to modify it live.

Any suggestions:

- how to measure a usefull freeze_timeout for am policy install?

- which values are usefull to set and which value we should not exceed?

Regards