monitoring issue

Wolfgang

Can someone please explain the different data for network traffic.

In Skyline monitoring, int he SP dashboard we saw around 9 Gb/s incoming and outgoing network traffic.

With "asg perf -vs all -v -vv" I expect the same, but only around 2Gb/s are shown.

Which data is collected for the values in asg perf and which for Skyline?

Oliver_Fink

Skyline provides an OpenTelemetry CPView Agent service. The OpenTelemetry CPView Agent runs on a Check Point server to collect and export health metrics from the Check Point CPView tool to an external location.

Oliver_Fink

I also found this: sk183505 – The number of concurrent connections reported by the "asg perf" command does not match th...:

Check Point utilizes various tools and frameworks to collect and analyze performance statistics on its platforms. Two key components in this context are the CPView tool and the "asg perf" command (on Scalable Platforms), each relying on different data sources for their operation.
[…]

CPView: Obtains performance data from dedicated internal producers within the system, offering a broader and more detailed view of the overall system performance.

asg perf: Retrieves the performance statistics directly from SecureXL.

Gennady

Good day!
My best guess is that you have sub interfaces configured. Dashboard shows aggregated data for all interfaces, it doesn't separate, for example, bond10, bond10.101 and bond10.102. It will show sum of all the values in throughput IO.

Plus there is "Total" value which is also added to the overall throughput by default.

To get the most accurate throughput via Security Group it is better to display only BPEthX interfaces in the dashboard.