VS monitoring in Checkpoint

[Deepika2109]

Hi ,

Guys , We are planning to implement VS level monitoring in our organization.

Monitoring tool : NNM (Network node manager) and HP OMi

Version R.80 

Please assist how can we proceed and what all is required . Currently overall monitoring is going on i.e VS0 

So , please help me out if anyone has idea.

Regards

Deepshikha

[PhoneBoy]

Define precisely how this tool is monitoring.
Also define precise version (R80 is a Management release, it is most likely R80.x).
If it monitors via SNMP, refer to: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Deepika2109]

Thanks..Seems helpful..

It will be great if you can help me out with one more query which is very urgent.

While running below command on Checkpoint which is basically kernel debug command , We got OSPF flaps.

Do you have any clue what could be the reason for it ?

1. Open first SSH to the GW and run the traffic capture:
# tcpdump -penni any host <src_IP> and host <dst_IP> -s0 -w traffic.pcap

2. Open second SSH to the GW and run the debug:
# fw ctl debug 0
# fw ctl debug -buf 32000
# fw ctl debug -m fw + conn drop vm
# fw ctl kdebug -T -f > DBG.txt

3. Replicate the issue.

4. Stop the debug and traffic capture:
Traffic: # CTRL + C
Debug: # fw ctl debug 0

5. Stop the traffic capture:
# CTRL + C

[Wolfgang]

Deepika2019,

with this kind of debug I think you have fully utilized CPU ressources, this will be result in the mentioned OSPF problems.

I think, you got these debug commands from TAC, talk to them to get a more granulary debug script or do these debugs in a maintenance window.

Wolfgang

[Deepika2109]

Thanks Wolfgang for your response but the point these commands are already run from our end and led to production outage as we missed out the warning from tac to take maintenance window..but the point is we found OSPF flaps which led to outage now we just want to understand Why Kerne debug run led to OSPF flaps ..What could be the reason for that

Now tac is taking too much time to give response , thats why I thought to discuss here

[Deepika2109]

Also as you said this could be CPU memory issues , then for your information , the device is this is very high end box i.e 23500 model FW having no issue with CPU and Memory.

[PhoneBoy]

Debugs will always cause increased CPU and I/O usage.
I can see how that might lead to OSPF flapping since there is timing involved with OSPF.
It's why we generally recommend debugs be executed in outage windows.

[Deepika2109]

Hi ,

So , you mean to say other than this nothing else could be the reason for OSPF flaps . Is that so ?

[PhoneBoy]

It's a possible reason, yes, but unless you were debugging OSPF at that same time, we can't say for certain.

[Deepika2109]

If I provide you the logs of that time , will it be possible to find out or comment ?

[PhoneBoy]

The logs alone might not be enough for that.
In any case, that might be best taken with the TAC.

[Deepika2109]

Hmm OK ..in that case it's already going on however no significant response till now. by d way Thanks for your assistance

[SharonElmashaly]

@Deepika2109  - my name is Sharon Elmashaly and I am leading the global Customer Support at Check Point. I would like to help here.

Please send me an email with the SR number and we'll take it from there.

Regards,

Sharon Elmashaly
VP, Customer Support
Check Point Software Technologies
E-mail: elmashaly@checkpoint.com

[Deepika2109]

Hi Sharon ,

Thanks a lot for your kind support however it is under progress with TAC.