zdebug command

[Leandro_K]

Hi,

I was running the following debug command "fw ctl zdebug + all | grep <ip address>", the command ran for +- 1 minute while I was testing connectivity. I received the following message  "fwkdebug: buffer full. messages lost." Where after the gateway dropped all connections and no traffic could pass via the gateway. I could still access the gateway via SSH and Gaia but no networks behind the gateway was able to operate. I had to reboot the gateway to restore operations.

Is there a better way for using the zdebug command and is it recommended for use in a Production environment?

The gateway is a 7000 appliance

Thanks

[G_W_Albrecht]

See both of this discussions:         Tcpdump + Zdebug                and https://community.checkpoint.com/t5/General-Topics/fw-ctl-zdebug-this-is-wrong/m-p/9690?search-actio...

[Tal_Paz-Fridman]

Hi

Try running the fw ctl debug command instead.

Look at sk98799 or sk171943 for advanced fw ctl debug features (for example larger buffer)

[PhoneBoy]

fw ctl zdebug is a "macro" of various fw ctl debug commands that is not applicable in all situations.
It will also generate a lot of debug in a large production environment.

It is far better to do much more targeted debug commands depending on the precise nature of the issue you're trying to track down.
The SKs that @Tal_Paz-Fridman pointed you at will help you craft those commands.
In general, it is advisable to execute the various debug commands during maintenance windows when possible.

[Dario_Perez]

you are runing debug with all flag enable, keep in mind that is really heavy. 

you need to run specific flag. but even with some flag debug can be really heavy. 

I suggest create a Ticket and leave TAC leading this