Dr. Spark report - dispatchers and cores is incorrect

[DeeAbrams]

I have 4 Spark 1800 appliances. The Dr. Spark report is showing an error for "CoreXL and Dispatchers". It says,

Test failed.
The numbers of CoreXL instances, dispatchers and cores is incorrect.
They should hold the following: #CoreXL instances + #Dispatchers = #Cores.
On this gateway: #CoreXL instances = 10.
#Dispatchers = 6.
#Cores = 12.

However, CPView is shown below.

# fw ctl affinity -l -r
CPU 0: fw_0 (active)
CPU 1: fw_1 (active)
CPU 2: fw_2 (active)
CPU 3: fw_3 (active)
CPU 4: fw_4 (active)
CPU 5: fw_5 (active)
CPU 6: fw_6 (active)
CPU 7: fw_7 (active)
CPU 8: fw_8 (active)
CPU 9: fw_9 (active)
CPU 10:
CPU 11: WAN
All: iked iked

Not sure what the others mean and I don't see cpconfig on the Spark appliances.

[ohadp]

Ill check it

[Chris_Atkinson]

Which firmware version & build are these 1800s installed with?

[ohadp]

Hi, seems that you are using an old version. But I'm concerned that it wasn't updated to the latest one (always takes the latest from the cloud), can you share an email or something - to send me the report itself?

[DeeAbrams]

These devices don't have internet connectivity, as they are part of an internal network. So they don't have connectivity to the Checkpoint cloud. This issue was first discovered in R81.10.07. We then upgraded to R81.10.10 (996002845) & the issue persists.

[ohadp]

Make sense, you are using the default version (the old one) we have many versions that we published after.

Contact me and ill guide you on how to install it (even if you do not have Internet connection) 

[DeeAbrams]

It was a typo. My bad. The current version on the Spark 1800 that we installed is R81.10.10 (996002845), not R80. Is there a version above R81.10.10 (996002845)?

[ohadp]

I meant Dr. Spark version - this is a tool that not related to any Spark versions.

We managed it in the cloud - so we can upload versions fast and quickly.

The tools (Spark + Load) are for any HW or FW. the logic is inside.

[DeeAbrams]

Dr. Spark version is 992002396, which came pre-installed in R81.10.10.

[ohadp]

In the cloud - 992002419, you have 20+ versions gap...
Need to install it manually 

[G_W_Albrecht]

How is that possible ? I assume that the doctor-smb.sh does the upgrade, or at least when drSMB diag is run, the tool is updated from the internet. But how to update drSMB offline ?

[ohadp]

only if you have the drSMB.sh file copied locally (it will extract all tests and logic into your gw) the UI is already inside the gw version

[G_W_Albrecht]

And that drSMB.sh file is available where ?

[ohadp]

Its in CP domain.
I can create SK with the latest version and instructions on how to install the latest version with no internet access

[G_W_Albrecht]

I think that would be much appreciated !

[ohadp · Accepted solution]

Done 

Here is the updated “Dr. Spark” topic in the Locally Managed Admin Guide:

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Content/Topics/DrSp...

The updated topic also appears in the Centrally Managed Admin Guide:

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Dr...

In the CLI Guide:

https://sc1.checkpoint.com/documents/SMB_R81.10.X/CLI/EN/Content/Topics/Working-with-Dr-Spark.htm?To...

[G_W_Albrecht]

Very good, i have missed that corrections to tthe CLI Guide for some time now 😉 But i still miss an update command that checks for the most current version !

[LouisC]

It seems that the download link from the admin guide is not working now.

Could you please help to check where can we download the latest Dr. Spark?

[ohadp]

Please check again; for some reason, the link was broken on Thursday.

If it’s still not working, contact me in person.

[DeeAbrams]

This issue was first discovered in R81.10.07. We then upgraded to R81.10.10 (996002845) & the issue persists.

[Chris_Atkinson]

Seems your options here are as follows:

1. Perform offline update process for Dr. Spark in consultation with @ohadp 

2. Set proxy settings locally so the appliance can communicate for updates (only if permitted / possible).

3. Ignore the Dr. Spark results (this could be misleading in future if outdated and used for diagnostics purposes)