fw ctl sdstat

Description The IPS performance counters measure the percentage of CPU consumed by each IPS protection. The measurement itself is divided according to the type of protection: Pattern based protections or INSPECT based protections. In addition, the IPS counters measure the percentage of CPU used by each section ("context") of the protocol, and each protocol parser.

Syntax

> fw ctl zdebug >& outputfile
> fw ctl sdstat start
> fw ctl sdstat stop

Parameter	Description
`fw ctl zdebug >& outputfile`	Turn on debug mode and specify an output file.
`fw ctl sdstat start`	Activate the IPS counters
`fw ctl sdstat stop`	Print a report and stop the counters.

Example The workflow is as follows:

Run the following commands on the Check Point Security Gateway (version R70 or higher):

On the Check Point Security Gateway:

Run fw ctl zdebug >& outputfile
Run fw ctl sdstat start

Let the counters run. However- do not leave the counters on for more than 10 minutes.

Run fw ctl sdstat stop

It is important to stop the counters explicitly, otherwise there may be performance penalty

This generates the output file outputfile that must be processed on the (SecurePlatform only) Security Management Server.

On the Security Management Server:

From $FWDIR/script, run the script
./sdstat_analyse.csh outputfile

The output of the script is a report in csv format that can be viewed in Microsoft Excel.

If there is a problem in the report, or if more details are needed, a debug flag is available which prints extra information to outputfile.

Run fw ctl zdebug + spii >& outputfile

Example Debug Message	Explanation
`sdstat_get_stats_all_instances : Smart Defense report objects are not initalized, hence no report can be done.`	User tried to create a report without initializing the counters, or an error occurred during initialization and the user then tried to print a report.
`FW-1 - sdstats_print_report: Failed to calculate Smart Defense (total_smart_defense is 0)`	The measurement process failed and the total time units for IPS is zero.

Comments

A value in the report of "< 1" means that the percentage of CPU used by a protection is less than 1%.
The report generated by the sdstat_analyse script may contain a number instead of a protection name. This is because the original output contains a signature id, but the id is missing from the Security Policy on the Gateway.