Policy install duration

[Simon_Macpherso]

Hi all,

How do you check the policy installation duration?

Regards,

Simon

[PhoneBoy]

You mean how long the policy install is taking?
I don’t believe we instrument it, or if we do, we don’t expose that anywhere.

[Chris_Atkinson]

In the bottom left hand corner of SmartConsole you have the "Tasks" section to view progress/status etc 

The "Details" option should provide you more info including the Start & Completion Time.

[Timothy_Hall]

Hi @Chris_Atkinson it would be helpful if the granularity of the times displayed at the start and end of a policy installation in the Tasks area of SmartConsole could be increased to show not just the hour and minute but also seconds as well.  Thanks!

[Chris_Atkinson]

The use case might be diminished now with accelerated policy install in R81 (sk169096) but thanks for the feedback I'll pass it along.

/Edit: Now available with R81 SmartConsole Build 549 and above: 

[the_rock]

I am pretty positive that sk is 99% wrong...I seen it before and tested in R81 lab and literally none of those things apply. Not sure who from Check Point came up with that list, but I would be curious to know exactly what type of testing they did  : )

[Chris_Atkinson]

Requires management & gateway to be R81, was that the case in your lab?

[the_rock]

Exactly that! And I know you guys like to always ask people to install latest jumbo, so I did...jumbo 13. Makes no difference. Try it yourself and you will see.

[Chris_Atkinson]

What was the specific symptom, the policy failed to install or just took longer than you expected to complete?

Perhaps some testing with and without it disabled (sk168055) is needed to quantify further.

@Eran_Habad 

[the_rock]

For 7 rules, it takes almost 3 minutes, which is ridiculous : ). I did all my testing, you work for CP, so you are welcome to test it yourself.

[Chris_Atkinson]

All applicable policy install operations are completing well within a minute or less in my R81 lab.

Test 1: Adding new rules.

Test 2: Adding new services to existing rules.

[the_rock]

Maybe mine is "broken" due to the fact I followed script to fix geo policy being hidden in R81. I will clean install it tomorrow and see what happens.

Andy

[Chris_Atkinson]

Try testing without the Geo objects if used.

Not seeing those or Updatable objects listed in sk169096 as qualifying for accelerated policy install as yet.

[the_rock]

Ok, so here is what I did...did reinstall of R81 on my standalone lab config and that seemed to fix it. I created 10 rules, few of them geo policy, and it takes 35 seconds to install, so I think its working fine! Thanks guys.

[PhoneBoy]

Keep in mind Accelerated Policy Install will not accelerate all policy installs. 
The first install of a newly created policy will take longer for sure.
However, subsequent changes to said policy should be much faster (assuming they are as described in sk169096). 

[Tomer_Noy]

Thanks Tim.

We actually had the same idea, because we wanted to "show off" how many seconds the accelerated policy installation took. In the upcoming SmartConsole update for R81, we changed the task information for policy installation tasks to show the seconds as well 😀

In general, if you want to see if your policy installation was accelerated, look at the icon. If there's a small lightning there, then it was accelerated. If not, then you can hover over it to see the reason that it wasn't accelerated.

Last, remember that the gateway is also doing some processing during policy installation. This was greatly optimized with the accelerated installation flow, but a heavily loaded gateway may still take longer than a reasonably loaded one.

[Timothy_Hall · Accepted solution]

On an R80+ SMS all policy install events are logged to a special file $FWDIR/log/install_policy.elg with timestamps.  In particular try seeking out **##PERF_MSG_IDENTIFY##** records in that file, as they appear to have the duration information you need, but it is not exactly easy reading:

**##PERF_MSG_IDENTIFY##** {"duration_data":[{"duration":0.4473197529999826,"name":"duration_of_code_generation#A-GW-Cluster"},{"duration":4.560813636999992,"name":"duration_of_policy_commit#A-GW-Cluster"},{"duration":0.9066284540000029,"name":"duration_of_policy_compilation#A-GW-Cluster"},{"duration":0.7535922519999899,"name":"duration_of_policy_transfer#A-GW-Cluster"}]}&CURRENTVERCMP

[Simon_Macpherso]

Thanks @Timothy_Hall 

That is the file I was looking for but couldn't recall it's name and location. 

Regards,

Simon

[the_rock]

What Chris said is pretty much the only way I know...you can see the percentage mind you, not the time itself, so technically, there is really no way to know how much time had elapsed since the policy install began. But, thats something that sounds like a nice feature CP could add in the future.