Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
ESpataro
Contributor

Cluster Failover

Can anyone tell me from the below the reason for this failover ?

 

Cluster Mode:   High Availability (Active Up) with IGMP Membership

ID         Unique Address  Assigned Load   State          Name                                              

1          1.1.1.1         0%              STANDBY        kerberus1      
2 (local)  1.1.1.2         100%            ACTIVE         kerberus2      


Active PNOTEs: None

Last member state change event:
   Event Code:                 CLUS-114904
   State change:               ACTIVE(!) -> ACTIVE
   Reason for state change:    Reason for ACTIVE! alert has been resolved
   Event time:                 Thu Oct 13 14:48:32 2022

Last cluster failover event:
   Transition to new ACTIVE:   Member 1 -> Member 2
   Reason:                     Available on member 1
   Event time:                 Thu Oct 13 12:44:14 2022

Cluster failover count:
   Failover counter:           16
   Time of counter reset:      Thu Nov 25 20:44:45 2021 (reboot)

0 Kudos
6 Replies
ESpataro
Contributor

Reason: FULLSYNC PNOTE - cpstop message on other cluster member , I have not sure what this means

0 Kudos
PhoneBoy
Admin
Admin

I would interpret that to mean someone typed cpstop into the relevant gateway.
Given that stops all Check Point services, it would definitely cause a failover…

G_W_Albrecht
Legend
Legend

No - the Event time is clear in 12:44 Failover, 14:48 State Change - better look into the logs !

CCSE CCTE CCSM SMB Specialist
Alexander_Wilke
Advisor

Hello,

 

Check the /var/log/messages and compare the CLUS messages to this sk125152

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

0 Kudos
the_rock
Legend
Legend

As @PhoneBoy said, message you gave means someone issued cpstop on the active member, which would have caused the failover, for sure.

0 Kudos
Alexander_Wilke
Advisor

The event CLUS-114904 only tells you that it moved from ACTIVE (!) to ACTIVE.

This was at 14:48:32

 

2hrs BEFORE that event something else happend.
We only know this:
Transition to new ACTIVE:   Member 1 -> Member 2

But we do not know the reason for that. To understand the reason like @G_W_Albrecht  said you have to look into the logs.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events