Cluster Failover

[ESpataro]

Can anyone tell me from the below the reason for this failover ?

Cluster Mode:   High Availability (Active Up) with IGMP Membership

ID         Unique Address  Assigned Load   State          Name                                              

1          1.1.1.1         0%              STANDBY        kerberus1      
2 (local)  1.1.1.2         100%            ACTIVE         kerberus2      


Active PNOTEs: None

Last member state change event:
   Event Code:                 CLUS-114904
   State change:               ACTIVE(!) -> ACTIVE
   Reason for state change:    Reason for ACTIVE! alert has been resolved
   Event time:                 Thu Oct 13 14:48:32 2022

Last cluster failover event:
   Transition to new ACTIVE:   Member 1 -> Member 2
   Reason:                     Available on member 1
   Event time:                 Thu Oct 13 12:44:14 2022

Cluster failover count:
   Failover counter:           16
   Time of counter reset:      Thu Nov 25 20:44:45 2021 (reboot)

[ESpataro]

Reason: FULLSYNC PNOTE - cpstop message on other cluster member , I have not sure what this means

[PhoneBoy]

I would interpret that to mean someone typed cpstop into the relevant gateway.
Given that stops all Check Point services, it would definitely cause a failover…

[G_W_Albrecht]

No - the Event time is clear in 12:44 Failover, 14:48 State Change - better look into the logs !

[Alexander_Wilke]

Hello,

Check the /var/log/messages and compare the CLUS messages to this sk125152

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[the_rock]

As @PhoneBoy said, message you gave means someone issued cpstop on the active member, which would have caused the failover, for sure.

[Alexander_Wilke]

The event CLUS-114904 only tells you that it moved from ACTIVE (!) to ACTIVE.

This was at 14:48:32

2hrs BEFORE that event something else happend.
We only know this:
Transition to new ACTIVE:   Member 1 -> Member 2

But we do not know the reason for that. To understand the reason like @G_W_Albrecht  said you have to look into the logs.