SmartView Tracker

Overview of Logging

SmartView Tracker enables you to view entries in the Log File. Each entry in the Log File is a record of an event or an account record. SmartView Tracker gives you control over the information displayed in the Log File. You can navigate through the Log File and select the log entries that you would like to display. You can view the log entries for all the installed Check Point products or for a selected product, such as QoS or VPN.

Two types of events are logged. The table below describes features unique to event logs:

SmartView Tracker Non-Accounting Log Events

The next table describes the features unique to accounting logs.

Explaining the Accounting SmartView Tracker Log

The following two conditions must be met for a connection to be logged:

• The QoS logging checkbox must be selected in the Gateway Properties - Additional Logging Configuration window must be selected. (By default this is automatically selected.)
• The connection's matching rule must be marked with either Log or Account in the Track field of the rule. See To Confirm that the Rule is Marked for Logging and To Modify Tracking for a Rule.

Further information on how to start the SmartView Tracker can be found in Enabling Log Collection.

Examples of Log Events

This section describes the log events in the SmartView Tracker:

Connection Reject Log

The connection is rejected because the rule exceeds the number of guaranteed connections, where Accept additional non-guaranteed connections is unchecked in the QoS Action Properties window (see QoS Action Properties). The log will include the name as well as the class of the rule in the following format: rule_name:<class>-><name>.

In the following example, the rule belongs to the class Best_Effort. The name of the rule (rule_name) is udp2.

Connection Reject Log — Example

LLQ Drop Log

When a packet from the LLQ connection is dropped, LLQ information is computed and logged from the last time a log was generated. This information includes significant data logged from the relevant interface-direction. In the following example, the information logged includes:

• s_in_llq_drops: The number of bytes dropped from the connection on the Server-In interface direction.
• s_in_llq_avg_xmit_delay: The average delay computed for all the connection's packets that were not dropped on the Server-In interface direction.
• s_in_llq_max_delay: The maximum delay of a connection packet that was not dropped on the Server-In interface direction.
• s_in_llq_xmit_jitter: The maximum delay difference between two consecutive successfully transmitted packets of the connection on the Server-In interface direction. Any packets which are dropped in between the two successfully transmitted packets are ignored.
• s_in_llq_recommended_delay: The default delay that can be entered into the Add Low Latency QoS Class Properties window in order to achieve a minimal number of dropped bytes.

LLQ Drop Log — Example

In the above example relevant data was observed only on the Server-In interface direction, therefore only Server-In counters are available.

Pool Exceeded Log

The designated size of the pool is exceeded, whether the pool is set for a particular interface direction, or whether it represents the global pool. In the following example, the information logged includes:

• an interface direction (ifdir) has a pool size of 8 fragments
• the interface name is E100B1, and the direction is outbound (marked by little cube juxtaposed to the interface name which has an outward pointing arrow) in the Interface column.

Pool Exceeded Log — Example

Examples of Account Statistics Logs

In SmartView Tracker, the account logs always include the segment_time information (the time from which the information about the log was gathered) in the Information column.

The Mandatory Fields in Account Logs

Account Logs may include any or all of the above information:

General Statistics Data

These statistics include the number of bytes transmitted through QoS in any relevant interface direction. In the following example:

• s_in_bytes: 5768 bytes were transmitted through QoS on the Server-In interface direction.
• s_out_bytes: 154294 bytes were transmitted through QoS on the Server-Out interface direction.

General Statistics Data — Example

Drop Policy Statistics Data

The number of bytes dropped from the connection in any relevant interface direction as a result of drop policy are logged. The drop policy is aimed at managing QoS packet buffers, see WFRED (Weighted Flow Random Early Drop). This includes the total number of bytes dropped from the connection since it exceeded its allocation. In the following example:

• s_out_total_drops: 3914274 bytes were dropped from the connection as a result of drop policy, on the Server-Out interface direction.
• s_out_exceed_drops: Out of total number of drops (s_out_total_drops) 3914274 bytes were dropped from the connection because it exceeded its allowed number of fragments, on the Server-Out interface direction.

Drop Policy Statistics Data — Example

LLQ Statistics Data

Data items are the same as in LLQ Drop Log, but are generated from the beginning of the connection, not from the last time a log was created.