Smart-1 700/7000 SMT & CPU

[Timothy_Hall]

Can someone with access to one of the new Smart-1 700s and/or 7000s please run the following commands from expert mode and post the output? 

cat /sys/devices/system/cpu/smt/active

cat /proc/cpuinfo

I'm curious to see the CPU type and whether SMT/Hyperthreading is enabled.  The general advice for SMSs is to leave SMT disabled as it causes around an 11% performance penalty, at least for R81.20, according to sk104788 (which no longer exists).  I'm curious to see the default SMT setting for these new models, which will presumably be running R82.  Thanks!

[the_rock]

First one shows 1 and there you go for 2nd one:

processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 142
model name : Intel(R) Celeron(R) CPU J4105 @ 1.50GHz
stepping : 10
microcode : 0x32
cpu MHz : 1500.000
cache size : 4096 KB
physical id : 0
siblings : 4
core id : 0
cpu cores : 4
apicid : 0
initial apicid : 0
fpu : yes
fpu_exception : yes
cpuid level : 22
wp : yes

Andy

[Timothy_Hall]

I assume that is a 700?

[the_rock]

Yep. I dont have 7000 to check, sorry.

[the_rock]

I just texted customer that has 7000 and they said output is 1 and there are 10 cpu cores, hyperthreading enabled. 

Andy

[Timothy_Hall]

Great, thanks!

[the_rock]

Glad we can help.

[John-Haynes · Accepted solution]

A 7000 series is 56-core (2x 28-core) with no SMT enabled.

[the_rock]

Fair enough...its possible they may had texted me wrong info then, thanks for confirming @John-Haynes 

[Chris_Atkinson]

Note there are three different 7000 series models and the Quantum gateway.

Source: https://www.checkpoint.com/resources/items/datasheet-quantum-smart-1-7th-generation 

[the_rock]

Ah, okay, so maybe was correct, just a different model.

Andy

[John-Haynes]

For clarification:

Platform: 7X-20-00
Model: Smart-1 7000-UL - 56-cores (2x 28-core) with no SMT enabled

Listed specs from the UC:

700S - 4-core

700M - 14 Core

70000L - 24-core

7000XL - 48-core

7000UL - 56-core

[Timothy_Hall]

Thanks, my goal here is to determine if SMT/Hyperthreading is currently recommended for SMSs, and I thought determining the SMT status on the latest Smart-1 appliances would help. At one point, it was not recommended due to the presence of many single-threaded processes (like fwm) on an SMS handling numerous tasks.  (Hyperthreading Best Practice Recommendation For Management / SmartEvent Open Servers?)  This type of workload does not benefit from SMT and would take an approximate 11% penalty with SMT. Apparently, there was also a bottleneck in the storage controller driver and/or file system type (ext3 vs XFS) that SMT would exacerbate.

However, it appears from these 700/7000 findings that SMT is enabled below a certain number of total cores and disabled at some higher number of total cores.

It also appears that more management processes have been multi-threaded in R82, and the storage controller drivers, along with the kernel were updated to 4.18 in R82.  So I'm wondering if this recommendation still holds for R82, which is recommended now.  Tagging @BenMorris and @Tomer_Noy for an update.

[Patrick_Jung]

Hi, Timothy.

I set up a Smart-1 700s with R82.10 today, but to be honest, it wasn’t as snappy as I had hoped.

The migration via migrate_server felt much slower than I expected. Even though the benchmarks say the 700s is faster than the old 600s, the 600s actually felt more responsive in real-time. I guess my expectations were too high.

The specs show 4 cores (HT off) at 4400 MHz—basically a 9100-series CPU. I can pull the /proc/cpuinfo if needed, but I don't want to get on Check Point's bad side by being too specific about the hardware. The real issue is the CPU and HDD combo. We’re used to the performance of Dell Open Servers, so this feels like a major step down.

I’ve already told the sales team to look into different models next time.

I finished the Smart-1 700s installation a few hours ago and I'm already in bed now. I’ll check the client's system tomorrow and get you the info you're looking for.

Regards.

[Timothy_Hall]

Can you please run these commands on your 700S and post the output?  Then I should be able to answer your question.

cat  /proc/cpuinfo

cat  /sys/devices/system/cpu/smt/active

[Patrick_Jung]

Hi, 

The output of cat /proc/cpuinfo includes information from only one of the four processors.
The section from flags to bugs was omitted due to screen truncation.

processor: 2
vendor_id: GenuineIntel
cpu family: 6
model: 191
model name: 13th Gen Intel(R) Core(TM) i3-13100E
stepping: 5
microcode: 0x37
cpu MHz: 3300.000
cache size: 12288 KB
physical id: 0
siblings: 4
core id: 2
cpu cores: 4
apicid: 4
initial apicid: 4
fpu: yes
fpu_exception: yes
cpuid level: 32
wp: yes
bogomips: 6604.80
clflush size: 64
cache_alignment: 64
address sizes: 39 bits physical, 48 bits virtual

cat  /sys/devices/system/cpu/smt/active : 0 

The values above match the output of show asset all.

hostname> show asset all
Platform: 7S-10-00
Model: Smart-1 700-S
CPU Model: 13th Gen Intel(R) Core(TM) i3-13100E
CPU Frequency: 4400.000 Mhz
Number of Cores: 4
CPU Hyperthreading: Disabled

OS version.
hostname> show version all
Product version Check Point Gaia R82.10
OS build 464
OS kernel version 5.14.0-427.13.1cpx86_64
OS edition 64-bit

Regards.

[Don_Paterson]

Just curios. How much RAM is installed?

Default is 16GB and 32GB is the Max.

[Patrick_Jung]

The model I installed is the 16 GB version.

[Timothy_Hall]

I can't determine the CPU type in the 600-S from the datasheet (or from any other sources), which only says it has "6 cores".  I'm going to assume 6 "full" cores, non-SMT, since I doubt the 6 cores would be 3 cores with hyperthreading on the 600-S.  My guess would be an i3, Celeron, or maybe even an Atom.  The i3-13100E CPU in your 700-S has only 4 cores, with SMT disabled by default.  The 700-S data sheet states 4/8 cores, which is somewhat misleading because SMT is apparently disabled by default, leaving only 4 usable cores.  However, it is not just about the number of cores; 2 Xeon cores would be way faster than 6 Atom cores.

Other benchmarks can be examined like these, but keep in mind the numbers were probably gathered on version R82 for the 700-S and on some older version (R81?) for the 600-S, so newer code efficiency may make much more of a difference than CPU type or number of cores.  The 700-S looks much more capable, although the statistics don't look quite like an apples-to-apples comparison:

This leads to a broader discussion of whether SMT should be enabled on a Security Management Server.  I originally thought it was always disabled on all Smart-1 appliances, but it looks like some of them now have it enabled.  The only clarification I could find is that enabling SMT on an SMS results in an 11% penalty in sk104788 (now deleted), but that was for much older code versions.  I'm assuming Check Point runs an internal benchmark on new Smart-1 hardware, and that SMT is set appropriately for best management performance in most situations.  The recommendation to always disable SMT for management came from @Tomer_Noy, but that was in 2021.  Can we get an update on this recommendation, assuming R82 or R82.10 is in use on an SMS?

My understanding of whether SMT will assist management operations mostly comes down to whether the workflow is mainly single-threaded (process fwm) and needs to run as fast as possible without core contention (SMT hurts), or fully multi-threaded (process cpm) and can run on many cores simultaneously (SMT helps).  Obviously, there is a mixture of single and multi-threaded processes on an SMS (trending towards multi-threaded with each new release), so this is not an easy question to answer.  But I'll ask anyway: on an open server or VMware, does SMT help an SMS or MDS in R82/R82.10?  Are there any situations on a Smart-1 appliance where SMT should be changed from the factory default?

[Patrick_Jung]

Smart-1 600s CPU information is as follows.
It’s not an Atom CPU—it’s an Intel Core i5–series processor.

Platform: ST-600-S
Model: Smart-1 600-S
CPU Model: Intel(R) Core(TM) i5-9500E CPU
CPU Frequency: 3000.000 Mhz
Number of Cores: 6
CPU Hyperthreading: Disabled

Regards,
Yoon Jung.

[Alex-]

7000XL, 48 cores. SMT is 0.

processor       : 47
vendor_id       : GenuineIntel
cpu family      : 6
model           : 143
model name      : Intel(R) Xeon(R) Gold 5418Y
stepping        : 8
microcode       : 0x2b000620
cpu MHz         : 2001.000
cache size      : 46080 KB
physical id     : 1
siblings        : 24
core id         : 23
cpu cores       : 24
apicid          : 174
initial apicid  : 174
fpu             : yes
fpu_exception   : yes
cpuid level     : 32
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l3 cat_l2 cdp_l3 invpcid_single intel_ppin cdp_l2 ssbd mba ibrs ibpb stibp ibrs_enhanced tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid cqm rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb intel_pt avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local split_lock_detect avx_vnni avx512_bf16 wbnoinvd dtherm ida arat pln pts hwp hwp_act_window hwp_epp hwp_pkg_req avx512vbmi umip pku ospke waitpkg avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg tme avx512_vpopcntdq rdpid bus_lock_detect cldemote movdiri movdir64b enqcmd fsrm md_clear serialize tsxldtrk pconfig arch_lbr avx512_fp16 amx_tile flush_l1d arch_capabilities
bugs            : spectre_v1 spectre_v2 spec_store_bypass swapgs
bogomips        : 3981.31
clflush size    : 64
cache_alignment : 64
address sizes   : 52 bits physical, 57 bits virtual