Check Point Management maintenance

[Ob1lan]

Hi,

We notice our SmartConsole (R81) becomes quite sluggish over time. Once we upgrade our management appliance to a new version (like when we upgraded from R80.40 to R81), it's fast again, but it degrades over time.

What would be the maintenance actions we could do when it's getting too slow ? Something we can do on the database or else ? Maybe a magic script that would do a set of operations against the management DB and processes ?

We already checked the disk space and log retention, all looks fine and unchanged for years.

Thanks in advance for your advises.

Regards,

A.

[_Val_]

Maybe it worth to take this with TAC. Could be either DB or SmartConsole cache, or both. 

[the_rock]

Thats very interesting problem you have...I have few questions, hopefully we can help you with this. So, did this problem happen only after you upgraded from R80.40 to R81? What was the original version of the management? Did it come with R80.40 or is it a VM built with a different code all together? Is it a physical appliance?

Can you share output of show asset all from clish? Also, do you notice any specific process maybe consuming higher percentage of memory/cpu? I believe @Timothy_Hall provided someone with a script to run for similar issue in another post, I just have to search to see if I can find it for you.

[the_rock]

K, got it, below is the link...My apologies in advance as it might not be 100% related, but worth checking.

https://community.checkpoint.com/t5/Security-Gateways/Short-communications-disruptions/m-p/125030#M1...

[PhoneBoy · Accepted solution]

My guess is it's the number of database revisions that exist.
When you migrate to a new version, we only take the most recently database version across.
I assume, as you make changes over time, this makes the database...larger.
You can purge revisions using: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

In R81, we added an automatic purge function, which I believe we adjusted the settings for in R81.10.
You can see the settings for it with: https://sc1.checkpoint.com/documents/latest/APIs/#cli/show-automatic-purge~v1.8%20 
Note that R81.10 should also be faster for other reasons (namely we eliminate a solr instance).

[the_rock]

I always keep forgetting about DB revisions... @PhoneBoy ...any idea how many revisions are kept in R80.xx or R81 by default? I dont believe there is a manual setting like back in R77.xx where you can choose how long you wish to keep them.

[PhoneBoy]

R81.10 set some defaults.
Not sure about previous versions, but we do support the automatic purge API in JHF going back to R80.20: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

Which means: you can ask the API what the settings are.

[the_rock]

Thanks as always!

[Ob1lan]

Thanks for your answer, we'll have a look at those revisions and how to automatically purge them after a while.

Do you already recommend upgrading the management to R81.10 ?

[PhoneBoy]

Officially, R81 is the recommended release.
That said, we already have several hundred management installations on R81.10 with great feedback so far.

[Dorit_Dor]

As of “Do you already recommend upgrading the management to R81.10 ?”
I would personally say yes.

When we make release recommended, we recommend both the management and the GW - for simplicity, we avoid recommending mgmt separately from gw. 
But mgmt is safer to move to new version and risk of impact on production is much lower, therefore having mgmt on latest is reasonable and it gives you the opportunity to enjoy significant improvements (such as performance and scale of mgmt server as result of removal of solr indexing on mgmt objects, it remains in usage of logs index).

We do already have hundreds of customers that migrated their mgmt and things look good even though the official status to widely  recommended happens only once all scenarios of the version pass massive usage and validation.