Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Employee+
Employee+

Bandwidth utilization report based on source or destination

Jump to solution

Hi Expert,

One of my customer is trying to generate the report of bandwidth utilization based on Source, Destination and for that they have to enable accounting for the required rules. Now if they enable the account the accounting logs in each rule then how much load be increased on gateway and management/log server. They have separate dedicated log & Event server and currently have 10GB logs per day from 3 clusters. How much CPU, Memory and Storage needs to be increase on Mgmt & log server? They have mix of 13500/13800, 23900 & 41K/44K clusters and those are 20%-30% utilized in peak load.

   

Labels (3)
Tags (1)
0 Kudos
1 Solution

Accepted Solutions
Highlighted
Employee+
Employee+

Since you're asking about impact on the log server, please share the disk, memory and CPU usage on that server.

If you have headroom on the log server, it should be OK with adding Accounting. However, if you're already near maxing out, then doubling the amount of logs for those rules may have impact.

Accounting logs are pretty small, but so are FW logs. If those are the majority of your logs, and the relevant rules generate most of the 10GB, then the disk requirements may need to nearly double as well.

View solution in original post

0 Kudos
6 Replies
Highlighted

If you were to enable Accounting for all rules in the policy, expect roughly a doubling of log events being sent to the SMS/log server by the gateway(s).  In addition to the standard logging at the start of the connection, use of Accounting adds an extra consolidated log event when the connection ends, or every 10 minutes if the connection lasts that long.

Book "Max Power 2020: Check Point Firewall Performance Optimization" Third Edition
Now Available at www.maxpowerfirewalls.com
0 Kudos
Highlighted
Admin
Admin
I don't believe this will increase the usage of any of the above substantially as accounting data is largely tracked by SecureXL.
0 Kudos
Highlighted

Right using Accounting does not affect the eligibility for accelerating traffic on the gateway, but my take on the question was that it was more about the logging load increase on the SMS/log server.

Book "Max Power 2020: Check Point Firewall Performance Optimization" Third Edition
Now Available at www.maxpowerfirewalls.com
Highlighted
Employee+
Employee+

Thanks for your inputs, one last query - does it impact log server storage, if yes how much storage do we need to increase (if customer have 10GB logs per day without smart event.)

0 Kudos
Highlighted
Employee+
Employee+

Since you're asking about impact on the log server, please share the disk, memory and CPU usage on that server.

If you have headroom on the log server, it should be OK with adding Accounting. However, if you're already near maxing out, then doubling the amount of logs for those rules may have impact.

Accounting logs are pretty small, but so are FW logs. If those are the majority of your logs, and the relevant rules generate most of the 10GB, then the disk requirements may need to nearly double as well.

View solution in original post

0 Kudos
Highlighted
Employee+
Employee+

BTW, if you're using R80.10 and above, you can do something really nice with layers.

If you create an ordered layer and place it at the end (bottom), then all traffic that passes the previous layers will go through it as well. In order to be accepted, traffic must be accepted by all layers, so put a cleanup rule for Any-Any-Accept, Track=None. This will ensure that the layer doesn't change the traffic handling.

Now you can add rules above the cleanup for the specific traffic you want to log with accounting. For example: Source=my_network, Destination=dest_network,Accept, Track=Log+Accounting.

Any traffic between that source and destination will add accounting information to the logs. This way you don't need to "hunt down" the relevant rules in your big policy. Also, if you only need accounting on some sub network (that is smaller than the scope of the rule), then this way the accounting will be added more granularly.

You can also use this method to add Detailed or Extended logging on certain traffic. You can even add Alerts on certain suspicious traffic that you aren't sure you want to block.

0 Kudos