I. PhoneBoy 1. Are you exporting logs to a SIEM? If so, which one(s) and are you using Log Exporter or LEA?
- Ans: No we are not exporting logs to a SIEM. From what i know we only export logs from the Gateways and Sandblast to SMS.
2. What JHF level is your SMS?
II. Daniel_Taney 1. Can you post the output of cpwd_admin list
2. Regarding sk122073
- JHF :Take 103 installed
- Build: 161
- I’m using R80.10
- Regarding the solution in the SK, I’ve opened a case with checkpoint and the local partner before and they did not resolve the issue and I don’t have a clear explanation of why is this happening, so I got tired of trying.
III. Timothy Hall
1- Curiously you don't seem to be swapping much with your 8GB of RAM which is the typical cause of high wio. This could indicate a high level of disk overhead due to a very high level of logs coming into your SMS. Please post your logging rate from sk120341: How to monitor the Log Receive Rate on Management Server / Log Server R80 and above.
- cpstat mg -f log_server
- Log Receive Rate-stattest
- Log Receive Rate Peak-stattest
- Log Receive Rate Average (last 10 min)- stattest
- Connected Gateways Table
- Log Receive Rate Average (last Hour)- stattest
- doctor-log.sh –f
2- Also the presence of lea_session processes indicates that you are exporting logs to some kind of SIEM which will further increase hard disk utilization, try disabling this functionality and see if it helps.
Ans: can you explain me( wich commands to use) how to disable lea_session?
3- Finally your hard drive may be experiencing errors or about to fail which is causing long waits for hard drive access as the drive retrys various operations. Check /var/log/messages* on the SMS carefully, do you see any disk warnings or timeout messages? If so BACKUP THE SMS IMMEDIATELY and make plans to replace it and/or the hard drive.
Beyond that upgrading RAM beyond 8GB might help here, depending on the number of rules/objects in your configuration. High wio can also be caused by hardware other than the hard drive that is in the process of failing, but that is fairly unlikely.
Ans: I did no find any error and warning related to HDD, but I will look again.
Mauro de Sousa