AV/AB and APCL/URLF Update Schedules on gateways

[Maarten_Sjouw]

We have been running into some issues with a number of centrally managed SMB appliances (1450 and 1490) in the last week, running at 10 different locations around the world from Singapore to Rio the Janeiro. The issue seems to have been related to the scheduled updates on the devices, see sk101307.

This triggered us to look into this further, to find a way to make sure these updates would no longer be done at the same time. We found that in their wisdom Check point has set the update schedule for both blades to 2 hours, therefore always running the 2 updates at the same time. We have chosen to make sure that on all our customer environments to make changes to this schedule, also for customers with real GAIA appliances, just to make sure that these updates do not interfere anymore. The AV/AB update is now set by default to 1:50 and the APCL/URLF update to 2:17.

This way it will only run once every so many times at the same time. 

Is this something that other people ran into as well?

[PhoneBoy]

Have you looked at processes on the system while this is going on?

[Maarten_Sjouw]

On the SMB devices we are unable to get to them to do any troubleshooting, next to the fact that we don't have console access they just become unresponsive.

On the GAIA appliance we did not really check but changed the schedule as a precaution.

[G_W_Albrecht]

That scheduled TP Updates on SMB devices always run at the same time has been an issue mostly with 600/1100 models. To trigger TP updates at one time for each service, you can consult my article Perform scheduled scripted tasks on SMB devices.

[Maarten_Sjouw]

I have a case still open for this and the questions that are open in this  case are the following:

Why is the schedule interval for AV/AB and APCL/URLF updates on gateways set by default to the same interval?

Why is there no check in the Software to see if there is another update running at the same time?

What was changed May first when we had multiple customers that were seeing all their SMB appliances fail during busy times, while updates were running.

That the problem was caused by the simultaneous updates, is pretty clear as since we changed the intervals, we have not seen any of these devices fail.

[G_W_Albrecht]

Yes, same point as my 600/1100 - during busy times, the little box is unable to load simultaneous updates. But that is not needed as we can schedule a special time with low traffic.

[Maarten_Sjouw]

When you have a locally managed, it is simpler in that respect, when centrally managed, as they all are with us, the only thing you can do is set the interval between updates.

[G_W_Albrecht]

On locally managed SMB devices, you can set the occurence interval, a time of the day and select from the 4 TP Blades which should perform that. So you can either leave services out here - you will have to update them manually - or have all updates always at the same time.

A workaround for both locally and centrally managed SMB devices is available in my CheckMates article Perform scheduled scripted tasks on SMB devices.