Are you a member of CheckMates?
×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
It's not fullproof, true, but it's a good starting point that doesn't involve writing scripts. 
Houssameddine Zeghlache in regards to the granularity of cpview history mode being 1 minute, I looked into it more closely when researching my book and the per-minute historical numbers reported by cpview are the average of two samples taken 30 seconds apart. So a spike of some kind that occurs but is not still happening during one of the samples taken every 30 seconds will not show up at all in cpview's history mode, and this was noted in my book. Sar takes more of a running average over its sampling intervals and is some cases is preferred over cpview depending on what you want to inspect. Here is the table from the second edition of my book where these preferences are summarized, these are just my opinion of course:
--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com
I have an old, outdated script from years ago 
Usage: Before running the script please setup top so it always show all CPU's;
#top
Press 1
Press shift + w
Press Enter
Exit top
Verify that it shows all CPU's by entering top again Now we can run the script;
#dos2unix monitor.sh
#chmod +x monitor.sh
#nohup ./monitor.sh &
The script will now run in the background and will take specific outputs related to performance every 30 seconds.
They will be written into /var/log/output.txt
To kill the script;
#ps aux | grep monitor.sh
#lkill -9 [pid of monitor.sh]
You can change the time value to your needs.
#!/bin/bash
#
#
clear
echo "To stop the script press CTRL+C"
echo "Starting to probe the system . . "
echo ======================================================================== >> /var/log/output.txt
echo "=== The beginning of the probing process ===" >> /var/log/output.txt
date >> /var/log/output.txt
echo ======================================================================== >> /var/log/output.txt
sleep 5
while end_loop=0 # while this condition is TRUE -
do
echo "New run, collecting....."
echo "To stop the script press CTRL+C"
echo " "
echo ============================================================= >> /var/log/output.txt
date >> /var/log/output.txt
echo ============================================================= >> /var/log/output.txt
echo " " >> /var/log/output.txt
echo " " >> /var/log/output.txt
echo cat /proc/meminfo : >> /var/log/output.txt
echo "------------" >> /var/log/output.txt
cat /proc/meminfo >> /var/log/output.txt
echo " " >> /var/log/output.txt
echo cpstat os -f multi_cpu : >> /var/log/output.txt
echo "------------" >> /var/log/output.txt
cpstat os -f multi_cpu >> /var/log/output.txt
echo " " >> /var/log/output.txt
echo top -n1 -b : >> /var/log/output.txt
echo "------------" >> /var/log/output.txt
top -n1 -b >> /var/log/output.txt
echo " " >> /var/log/output.txt
echo ps -auxf : >> /var/log/output.txt
echo "------------" >> /var/log/output.txt
ps -auxf >> /var/log/output.txt
echo " " >> /var/log/output.txt
clear
echo " "
echo "GOING to SLEEP for 5 seconds, run complete"
echo " "
echo " "
echo "Please press CTL + C in order to break the script"
sleep 30
done
But best would be to ask CP TAC for the CPU spike monitor script "spike_monitor_cpk.sh" by Ariel L. Dor .
