This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
ABOUT CHECKMATES CYBER SECURITY COMMUNITY & FAQ
Help

Who rated this post

cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
KlowikiOne
Employee
Employee
2 weeks ago

I wanted to share a few methods to help avoid downtime during a debug.

When debugs load cpu utilization will increase significantly. I have seen a significant reduction in CPU utilization by setting a RAM disk up and have the debug output file sent to the RAM disk. Latency from disk IO is not as big of an issue by using RAM disks as the destination. 

  Setting the debug on the standby member of a cluster and failing over to the standby member after the debug is running will reduce any packet loss due to CPU utilization.  Be sure to add IP addresses involved for src and dst making the debug selective will reduce the size of the file created.  If the size of the file exceeds the size of the RAM disk the file will swap to disk. 

To specify IP addresses to limit debug file size 

fw ctl set str simple_debug_filter_addr_1 IPAddress1 -a

fw ctl set str simple_debug_filter_addr_2 IPAddress2 -a

RAM Disk

Note: In this example the RAM disk is a destination for a network capture. For a debug you would point the kdebug file to the RAM Disk.

#RAM Disk Process

#/*Make sure there is enough space. Memory swap does still work to disk if you go over the amount available. Ramfs does not support swap. */

#

#free -g

#

              total        used        free      shared  buff/cache   available

Mem:             15           8           0           1           6           5

Swap:            31           1          29

#

#/*  Create the location the new disk will mount.  */

#mkdir /mnt/rmdisk

#

#/*  Mount the ram as tmpfs and specify amount of ram to use and where to mount it. */

#

#mount -t tmpfs -o size=4g tmpfs /mnt/rmdisk

#

#/* You can cd into the directory and use it as a normal disk. Remember this is volatile memory and will be erased on reboot or dismount.  For Example: tcpdump. */

#

#tcpdump -enni any -w /mnt/rmdisk/dumpme.pcap

 
(1)
Who rated this post