R80.30 SmartView Monitor wrong values for "Accept Packet Rate" and "Bytes Throughput"

[GArndt]

Hello CheckMates-Community,

we see a strange behavior at SmartView Monitor for a freshly installed SG2200 Gateway with R80.30 [ build 205 (kernel: R80.30 - Build 212 / HOTFIX_R80_30_JUMBO_HF_MAIN Take:  215 ]:
In left tree of SmartView Monitor we choose "Gateway Status" and then "Firewalls":
Values at "Accept Packet Rate" and "Bytes Throughput" seem not to show values per second but all-time summary (since installation/reboot of gateway). Values are rising.
In graphic mode -via "System Counters" and then "System History" - we can see nearly linear increasing lines for both values. (See attached image.)

It does not make any difference, if we use "Monitor" as right-click in SmartConsole "Gateway& Servers" Tab at the gateway-device.

---

We had a SG15400 installed with R80.30 [ build 001 (kernel: R80.30 - Build 135 / HOTFIX_R80_30_JUMBO_HF_MAIN Take:  155 ] and see correct values (in table and graphic).

So, is it a problem of SG2200, or a problem of new HFA take 215 ?
Or something differnt?

If anybody is facing same strange values - please write.

Many thanks,
Gunther

[G_W_Albrecht]

I only know of:

R80.30 Takes
Security Gateway / Standalone Gaia 2.6.18 Take 200	Security Gateway Gaia 3.10 Take 273	Security Gateway Gaia 3.10 Take 300	Security Management Take 200

Did you look at Traffic > View properties... and that is set to ReaTime  ? If yes would suggest to test installing Jumbo HF Take_217 !

[GArndt]

Hi G_W_Albrecht,

Thanks for your reply!

Regarding: "Did you look at Traffic > View properties... and that is set to RealTime  ?"
-No, it is set (in the graphic properties) to "history", for we want to see historic curves and not the actual values (but these are wrong, too).

[GArndt]

Seems to be a problem earlier than R80.30 HFA take 215!
We have these strange values in figuers table and graphics for a cluster of two SG5200 with R80.30 take 196 !
R80.30 [ build 158 (kernel: R80.30 - Build 166 /  HOTFIX_R80_30_JUMBO_HF_MAIN Take: 196 ] 

As I havn't seen error-corrections (solved problems) regarding this topic in newly distributed HFAs, I assume it is an ongoing problem.

[ On my PC I upgraded to the newest SmartConsol build 91, but it didn't have any effect. - So, it must be something different. ]


We want to install some machines on Tuesday. If problem occurs there too, We'll have to open a case, anyhow.

BR,
Gunther 

[GArndt]

Update !

Official statement by Check Point ( after opening a case via our distributor ) :

"we are currently investigating our issue, we have seen  a few more similar cases ( with R80.30 Take 196), and we are working on a solution internally with our R&D department."

[GArndt]

Update 2 !
Now there is a sk170132: SmartView Monitor shows very large 'Bytes Throughput' and 'Accepted Packet Rate'
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

[Dror_Aharony]

Fix not yet in - still in late testing phase.

[GArndt]

Hello Dror_Aharony,

Unfortunately, this is not correct.  [<- statement is regarding former posting from Dror_Aharony. Before his edit it read: hotfix is already inluded in latestR80.30/R80.40]

We have updated a SG2200 to R80.30 HFA Take219 and the values shown are still incorrect.


In both descriptions to:
 R80.30 HFA Take 219 (and even in ongoin Take221 at this moment) as well as in
 R80.40 Take >=Take78
there is nowhere mentioned that this problem with SmartView Monitor is solved!

R80.30 Jumbo Hotfix Accumulator:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
(no: PRHF-13507 , PRHF-13511 , PRHF-13512 , PRHF-13513 to be seen yet)

We received this info from Check Point:
"...The hotfix will be integrated in the next JHF-Versions, however there is no ETA right now.
You can following those ID : PRJ-18082 & PRHF-13507 in sk153152 (Jumbo Hotfix Accumulator for R80.30 (R80_30_jumbo_hf)..."

It would be great if Check Point solves this problem in next JHF in status General Availability (GA)

[Dror_Aharony]

I apologize, fix is still under final testing pre-integration.
Next public JHFs should include it.

[GArndt]

Thank you for your quick response/correction. 
It would help a lot if Hotfix will be in next JHF.

[GArndt]

At Nov. 2nd the updated list of hotfixes included in next JHF(s) has been published:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

Unfortunately, the proposed hotfix for the SmartView Monitor problem (of this thread here) is not mentioned there!
We hope it will pop up as soon as possible and gets solved in next JHF.

[GArndt]

JHF R80.30 Take226 GA is out.
Next GA after Take219 GA, but problem with wrong values in SmartView Monitor seems to be still neither fixed nor even on the list of upcoming fixes in:
Jumbo Hotfix Accumulator for R80.30 (R80_30_jumbo_hf)
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

There is a special Hotfix available
(see sk170132: SmartView Monitor shows very large 'Bytes Throughput' and 'Accepted Packet Rate'
which applies to: PRHF-13507 , PRHF-13511 , PRHF-13512 , PRHF-13513,PRHF-13923 )

but we need it to be solved in GA! - When will it take place?

[GArndt]

JHF R80.30 Take226 GA  has now been enrolled on a SG4600 (kernel 2.6) and...
...surprise, surprise:
SmartView Monitor shows now the correct values (in figures and in graphs) again!

Is this a single case ?
Or is the problem really fixed without mentioning in list of fixed issues of R80.30  as well as in sk170132  https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...   ?

Does anybody have information  (before we enroll JHF R80.30 Take226 GA  on further gateways) ?

[Yifat_Chen]

The following hotfixes will be released only in the upcoming ongoing Jumbos ( R80.30 and R80.40 JHFs) - PRHF-13507 , PRHF-13511 , PRHF-13512 , PRHF-13513,PRHF-13923

Ballpark ETA is early next week. (GA is around 1M latter) 

[shais]

Hi,

As Yifat mentioned below, we have a fix that should be integrated soon.
The issue itself does not always reproduce, therefore, in some cases, it looks as if the issue is resolved.