How to listing TCP services with non-default tcp idle timout (virtual session timeout)

[Norbert_Papirny]

Hello everyone,

Is there a way listing TCP services with non-default tcp idle timout?

We must to put another non checkpoint firewall before the main cluster, and we need to know which tcp services has configured specific virtual session timout.

many thanks,

norbert

[_Val_]

(Had to delete my original reply as it was erroneous)

Okay, so we have two different cases:

1. Timeouts are lower than global settings, .ie. aggressive aging. Should not be problematic and does not need extraction.

2. Timeouts are higher than global. That only happens if you modify the service manually. I did not find an option to query those parameter on per service basis, but there is a way:

• find all services that were modified from default. Open object explorer and sort by "Modifier". Anything non-default will show with particular user names instead of "system"
• Manually go over advanced to see which modifications were affecting 

If I find a better way, I will let you know

[_Val_]

You can also dump all TCP services into a file with dbedit command something like:

echo -e "query services, type='tcp' \n-q\n" | dbedit -local > tcp.txt 

and then search there. Or event extend command to a script comparing default and actual timeout for each server.

[_Val_ · Accepted solution]

The third and last option is to get TCP services though API:

mgmt_cli -r true show-services-tcp details-level full

and then run it through analysis, comparing default and actual timeout on all services.

[Norbert_Papirny]

Hi,
thank for your your replies!
I used "details-level" instead of "default-level" and its worked! 🙂

[_Val_]

uh, it was a typo. fixed

[masher]

To follow-up on @_Val_'s responses, there are two different settings within a TCP service object that might be beneficial in your search. The "use-default-session-timeout" and"session-timeout" parameters can be used with with a select statement with jq in order to filter the service objects. 

[admin@vMgmt01]# mgmt_cli -s session show services-tcp details-level full -f json limit 500 | jq -r '.objects[]| select(."use-default-session-timeout"==false)|.name'
http_test1
http_test2

[admin@vMgmt01]# mgmt_cli -s session show services-tcp details-level full -f json limit 500 | jq -r '.objects[]| select(."session-timeout"<3600)|.name'
http_test1
icap
IKE_NAT_TRAVERSAL_TCP
...
[admin@vMgmt01]# mgmt_cli -s session show services-tcp details-level full -f json limit 500 | jq -r '.objects[]| select(."session-timeout">3600)|.name'
http_test

[Norbert_Papirny]

I tried to run the command, but I always get this error:

[Expert@xxxxxx:0]# mgmt_cli show services-tcp details-level full -f json limit 5 | jq -r '.objects[]| select(."session-timeout">3600)|.name'

parse error: Invalid numeric literal at line 1, column 9

Do you have any idea what i am doing wrong?

Many thanks,

norbert

[_Val_]

You need to add authentication. Either add user / password or "-r true" at the beginning of the command

[Norbert_Papirny]

yes, that was my fault, i forgot to put login information to the session file...
"mgmt_cli login>session"

thanks a lot, everything is working now!
🙂