Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 

Policy install duration

Jump to solution

Hi all,

How do you check the policy installation duration?

Regards,

Simon

0 Kudos
1 Solution

Accepted Solutions
Timothy_Hall
Champion
Champion

On an R80+ SMS all policy install events are logged to a special file $FWDIR/log/install_policy.elg with timestamps.  In particular try seeking out **##PERF_MSG_IDENTIFY##** records in that file, as they appear to have the duration information you need, but it is not exactly easy reading:

**##PERF_MSG_IDENTIFY##** {"duration_data":[{"duration":0.4473197529999826,"name":"duration_of_code_generation#A-GW-Cluster"},{"duration":4.560813636999992,"name":"duration_of_policy_commit#A-GW-Cluster"},{"duration":0.9066284540000029,"name":"duration_of_policy_compilation#A-GW-Cluster"},{"duration":0.7535922519999899,"name":"duration_of_policy_transfer#A-GW-Cluster"}]}&CURRENTVERCMP

New 2021 IPS/AV/ABOT Immersion Self-Guided Video Series
now available at http://www.maxpowerfirewalls.com

View solution in original post

18 Replies
PhoneBoy
Admin
Admin

You mean how long the policy install is taking?
I don’t believe we instrument it, or if we do, we don’t expose that anywhere.

0 Kudos

In the bottom left hand corner of SmartConsole you have the "Tasks" section to view progress/status etc 

The "Details" option should provide you more info including the Start & Completion Time.

0 Kudos
Timothy_Hall
Champion
Champion

Hi @Chris_Atkinson it would be helpful if the granularity of the times displayed at the start and end of a policy installation in the Tasks area of SmartConsole could be increased to show not just the hour and minute but also seconds as well.  Thanks!

New 2021 IPS/AV/ABOT Immersion Self-Guided Video Series
now available at http://www.maxpowerfirewalls.com
0 Kudos

The use case might be diminished now with accelerated policy install in R81 (sk169096) but thanks for the feedback I'll pass it along.

 

/Edit: Now available with R81 SmartConsole Build 549 and above: 

time.png

0 Kudos
the_rock
Champion
Champion

I am pretty positive that sk is 99% wrong...I seen it before and tested in R81 lab and literally none of those things apply. Not sure who from Check Point came up with that list, but I would be curious to know exactly what type of testing they did  : )

0 Kudos

Requires management & gateway to be R81, was that the case in your lab?

0 Kudos
the_rock
Champion
Champion

Exactly that! And I know you guys like to always ask people to install latest jumbo, so I did...jumbo 13. Makes no difference. Try it yourself and you will see.

0 Kudos

What was the specific symptom, the policy failed to install or just took longer than you expected to complete?

Perhaps some testing with and without it disabled (sk168055) is needed to quantify further.

@Eran_Habad 

 

0 Kudos
the_rock
Champion
Champion

For 7 rules, it takes almost 3 minutes, which is ridiculous : ). I did all my testing, you work for CP, so you are welcome to test it yourself.

0 Kudos

All applicable policy install operations are completing well within a minute or less in my R81 lab.

Test 1: Adding new rules.

Test_1.png

Test 2: Adding new services to existing rules.

Test_2.png

 

 

0 Kudos
the_rock
Champion
Champion

Maybe mine is "broken" due to the fact I followed script to fix geo policy being hidden in R81. I will clean install it tomorrow and see what happens.

 

Andy

0 Kudos

Try testing without the Geo objects if used.

Not seeing those or Updatable objects listed in sk169096 as qualifying for accelerated policy install as yet.

0 Kudos
the_rock
Champion
Champion

Ok, so here is what I did...did reinstall of R81 on my standalone lab config and that seemed to fix it. I created 10 rules, few of them geo policy, and it takes 35 seconds to install, so I think its working fine! Thanks guys.

0 Kudos
PhoneBoy
Admin
Admin

Keep in mind Accelerated Policy Install will not accelerate all policy installs. 
The first install of a newly created policy will take longer for sure.
However, subsequent changes to said policy should be much faster (assuming they are as described in sk169096). 

0 Kudos
Tomer_Noy
Employee
Employee

Thanks Tim.

We actually had the same idea, because we wanted to "show off" how many seconds the accelerated policy installation took. In the upcoming SmartConsole update for R81, we changed the task information for policy installation tasks to show the seconds as well 😀

In general, if you want to see if your policy installation was accelerated, look at the icon. If there's a small lightning there, then it was accelerated. If not, then you can hover over it to see the reason that it wasn't accelerated.

Last, remember that the gateway is also doing some processing during policy installation. This was greatly optimized with the accelerated installation flow, but a heavily loaded gateway may still take longer than a reasonably loaded one.

Timothy_Hall
Champion
Champion

On an R80+ SMS all policy install events are logged to a special file $FWDIR/log/install_policy.elg with timestamps.  In particular try seeking out **##PERF_MSG_IDENTIFY##** records in that file, as they appear to have the duration information you need, but it is not exactly easy reading:

**##PERF_MSG_IDENTIFY##** {"duration_data":[{"duration":0.4473197529999826,"name":"duration_of_code_generation#A-GW-Cluster"},{"duration":4.560813636999992,"name":"duration_of_policy_commit#A-GW-Cluster"},{"duration":0.9066284540000029,"name":"duration_of_policy_compilation#A-GW-Cluster"},{"duration":0.7535922519999899,"name":"duration_of_policy_transfer#A-GW-Cluster"}]}&CURRENTVERCMP

New 2021 IPS/AV/ABOT Immersion Self-Guided Video Series
now available at http://www.maxpowerfirewalls.com

Thanks @Timothy_Hall 

That is the file I was looking for but couldn't recall it's name and location. 

Regards,

Simon

0 Kudos
the_rock
Champion
Champion

What Chris said is pretty much the only way I know...you can see the percentage mind you, not the time itself, so technically, there is really no way to know how much time had elapsed since the policy install began. But, thats something that sounds like a nice feature CP could add in the future.

0 Kudos