Best Practice - Service Kdump enable or disable?

[stemax1]

Good morning at all,

I have a scalable platform firewall with 3 SGM (CP 44k).

Is it normal for the kdump service to be active on all 3 blades ? Could I turn it off if I don't need it? I currently have no hw problems but I would like to understand if it is right or not to keep it on.

Have a nice day.

[emmap]

Kernel dumps have been enabled in all CP versions by default since R76. As such we would recommend leaving it at the default configuration (enabled) unless you are having problems with it.

[Lesley]

This will explain it a bit more how it works:

https://support.checkpoint.com/results/sk/sk44186

I have never seen any issues to enable core dumps. They are very helpfull after a crash. Without it it is very difficult for Check Point to investigate a crash.

Second tip:

Check the HCP health check report, they also note if you had any crash dumps on the systems and tell you the location of the file and time/date. 

https://support.checkpoint.com/results/sk/sk171436

[the_rock]

Here is the thing...you can disable core dumps, system dumps, no way. As @Lesley said, its there for a reason, plus, if you think about it, makes it easier for support to help you if there is ever a crash and needs to be investigated by TAC/R&D

Andy

[Expert@CP-TEST-FW:0]# clish
CP-TEST-FW> set core
CP-TEST-FW> set core-dump
disable - Disable core dumps
enable - Enable core dumps
per_process - set dumps amount limit per process
total - set total space usage limit
CP-TEST-FW> set syste
CP-TEST-FW> set core-
CP-TEST-FW> set core-dump
disable - Disable core dumps
enable - Enable core dumps
per_process - set dumps amount limit per process
total - set total space usage limit
CP-TEST-FW> set core-dump