Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Deepika2109
Explorer

VS monitoring in Checkpoint

Hi ,

Guys , We are planning to implement VS level monitoring in our organization.

Monitoring tool : NNM (Network node manager) and HP OMi

Version R.80 

 

Please assist how can we proceed and what all is required . Currently overall monitoring is going on i.e VS0 

So , please help me out if anyone has idea.

 

Regards

Deepshikha

 

0 Kudos
13 Replies
PhoneBoy
Admin
Admin

Define precisely how this tool is monitoring.
Also define precise version (R80 is a Management release, it is most likely R80.x).
If it monitors via SNMP, refer to: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
Deepika2109
Explorer

Thanks..Seems helpful..

It will be great if you can help me out with one more query which is very urgent.

 

While running below command on Checkpoint which is basically kernel debug command , We got OSPF flaps.

Do you have any clue what could be the reason for it ?

 

1. Open first SSH to the GW and run the traffic capture:
# tcpdump -penni any host <src_IP> and host <dst_IP> -s0 -w traffic.pcap

2. Open second SSH to the GW and run the debug:
# fw ctl debug 0
# fw ctl debug -buf 32000
# fw ctl debug -m fw + conn drop vm
# fw ctl kdebug -T -f > DBG.txt

3. Replicate the issue.

4. Stop the debug and traffic capture:
Traffic: # CTRL + C
Debug: # fw ctl debug 0

5. Stop the traffic capture:
# CTRL + C


0 Kudos
Wolfgang
Leader
Leader

Deepika2019,

with this kind of debug I think you have fully utilized CPU ressources, this will be result in the mentioned OSPF problems.

I think, you got these debug commands from TAC, talk to them to get a more granulary debug script or do these debugs in a maintenance window.

Wolfgang

 

0 Kudos
Deepika2109
Explorer

Thanks Wolfgang for your response but the point these commands are already run from our end and led to production outage as we missed out the warning from tac to take maintenance window..but the point is we found OSPF flaps which led to outage now we just want to understand Why Kerne debug run led to OSPF flaps ..What could be the reason for that

Now tac is taking too much time to give response , thats why I thought to discuss here
0 Kudos
Deepika2109
Explorer

Also as you said this could be CPU memory issues , then for your information , the device is this is very high end box i.e 23500 model FW having no issue with CPU and Memory.
0 Kudos
PhoneBoy
Admin
Admin

Debugs will always cause increased CPU and I/O usage.
I can see how that might lead to OSPF flapping since there is timing involved with OSPF.
It's why we generally recommend debugs be executed in outage windows.
0 Kudos
Deepika2109
Explorer

Hi ,

So , you mean to say other than this nothing else could be the reason for OSPF flaps . Is that so ?
0 Kudos
PhoneBoy
Admin
Admin

It's a possible reason, yes, but unless you were debugging OSPF at that same time, we can't say for certain.
0 Kudos
Deepika2109
Explorer

If I provide you the logs of that time , will it be possible to find out or comment ?
0 Kudos
PhoneBoy
Admin
Admin

The logs alone might not be enough for that.
In any case, that might be best taken with the TAC.
0 Kudos
Deepika2109
Explorer

Hmm OK ..in that case it's already going on however no significant response till now. by d way Thanks for your assistance
0 Kudos
SharonElmashaly
Employee Alumnus
Employee Alumnus

@Deepika2109  - my name is Sharon Elmashaly and I am leading the global Customer Support at Check Point. I would like to help here.

Please send me an email with the SR number and we'll take it from there.

 

Regards,

Sharon Elmashaly
VP, Customer Support
Check Point Software Technologies
E-mail: elmashaly@checkpoint.com

0 Kudos
Deepika2109
Explorer

Hi Sharon ,

Thanks a lot for your kind support however it is under progress with TAC.

 

 

0 Kudos