Monitoring Performance (asg perf)

Description

Use the asg perf command in Gaia gClishClosed The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators. Commands you run in this shell apply to all Security Appliances in the Security Group. or the Expert mode to monitor continuously the key performance indicators and load statistics.

There are different commands for IPv4 and IPv6. You can show the performance statistics for IPv4 traffic, IPv6 traffic or for all traffic.

When you run this command, the statistics shows on the screen.

The output automatically updates after a predefined interval (default = 10 seconds).

To stop the command and return to the command line, press e.

Syntax

asg perf -h

asg perf [-b <SGM_IDs>] [-vs <VS_IDs>] [-k] [-v] [-vv] [-p] [-4 | -6] [-c]

asg perf [-b <SGM_IDs>] [-vs <VS_IDs>] [-k] [-e] [--delay <seconds>]

asg perf [-b <SGM_IDs>] [-vs <VS_IDs>] [-v] [-vv [ mem [{fwk | cpd | fwd | all_daemons}] | cpu [1m | 1h | 24h]]]

Parameters

Parameter

Description

-h

Shows the built-in help.

-b <SGM_IDs>

Applies to Security GroupClosed A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected. Members as specified by <SGM_IDs>.

<SGM_IDs> can be:

  • No <SGM_IDs > specified, or all - Applies to all Security Group Members and Sites

  • One Security Group Member (for example, 1_1)

  • A comma-separated list of Security Group Members (for example, 1_1,1_4)

  • A range of Security Group Members (for example, 1_1-1_4)

  • In Dual Site, one Site (chassis1, or chassis2)

  • In Dual Site, the Active Site (chassis_active)

-vs <VS_IDs>

Shows the status of Virtual Systems.

<VS_IDs> can be:

  • No <VS_IDs> specified (default) - Applies to the context of the current Virtual System

  • One Virtual System

  • A comma-separated list of Virtual Systems (for example, 1,2,4,5)

  • A range of Virtual Systems (for example, 3-5)

  • all - Shows all Virtual Systems

Note - This parameter is only applicable in a VSXClosed Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. environment.

-v

Shows statistics for each Security Group Member.

-vv

Shows statistics for each Virtual System.

Note - This parameter is only relevant in a VSX environment.

mem

Shows memory usage for each daemon.

Use this with -vv.

Possible values:

  • fwk (Default)

  • fwd

  • cpd

  • all_daemons

cpu

Shows CPU usage for a specified period of time.

Use this with -vv.

Possible values are:

  • 1m (default) - The last 60 seconds

  • 1h - The last hour

  • 24h - The last 24 hours

-p

Show detailed statistics and traffic distribution between these paths on the Active Site:

-4 | -6

  • -4 - Shows IPv4 information only.

  • -6 - Shows IPv6 information only.

If no value is specified, the combined performance information shows for both IPv4 and IPv6.

-c

Shows percentages instead of absolute values.

-k

Shows peak (maximum) system performance values.

-e

Resets peak values and deletes all peaks files and system history files.

--delay <seconds>

Temporarily changes the update interval for the current asg perf session.

Enter a delay value in seconds.Default delays is 10 seconds.

Notes:

  • The -b <SGM_IDs> and -vs <VS_IDs> parameters must be at the start of the command.

    If both parameters are used, -b <SGM_IDs> must be first.

  • If your Security Group is not configured in VSX mode, the VSX related commands are not available.

    They do not show when you run the asg perf -h command.

Below are some examples:

[Expert@MyChassis-ch01-01:0]# gclish
[Global] MyChassis-ch01-01> asg perf
Thu May 21 08:17:24 IDT 2015
Aggregated statistics (IPv4 Only) of SGMs: chassis_active VSs: 0
+--------------------------------------------------------------+
|Performance Summary                                           |
+----------------------------------------------+---------------+
|Name                                          |Value          |
+----------------------------------------------+---------------+
|Throughput                                    |751.6 K        |
|Packet rate                                   |733            |
|Connection rate                               |3              |
|Concurrent connections                        |142            |
|Load average                                  |2%             |
|Acceleration load (avg/min/max)               |1%/0%/4%       |
|Instances load (avg/min/max)                  |2%/0%/8%       |
|Memory usage                                  |10%            |
+----------------------------------------------+---------------+
 * Instances / Acceleration Cores: 8 / 4
 * Activated SWB: FW,IPS
[Global] MyChassis-ch01-01>

Notes:

  • By default, absolute values are shown.

  • Unless otherwise specified, the combined statistics for IPv4 and IPv6 are shown.

  • When no Security Group Members are specified, performance statistics are shown for the Active Security Group Member only.

The -v parameter adds a performance summary for each Security Group Member.

[Expert@MyChassis-ch01-01:0]# gclish
[Global] MyChassis-ch01-01> asg perf -vs all -v -vv cpu 24h
Tue Oct 22 07:23:37 IST 2013
Aggregated statistics (IPv4 and IPv6) of SGMs: chassis_active Virtual Systems: 0
+-------------------------------------------------------------------------+
|Performance Summary                                                      |
+---------------------------------------------+-------------+-------------+
|Name                                         |Value        |IPv4%        |
+---------------------------------------------+-------------+-------------+
|Throughput                                   |10.2 K       |100%         |
|Packet rate                                  |11           |100%         |
|Connection rate                              |0            |N/A          |
|Concurrent connections                       |22           |100%         |
|Load average                                 |7%           |             |
|Acceleration load (avg/min/max)              |6%/6%/6%     |             |
|Instances load (avg/min/max)                 |5%/4%/9%     |             |
|Memory usage                                 |55%          |             |
+---------------------------------------------+-------------+-------------+
 
+-------------------------------------------------------------------------+
|Per SGM Distribution Summary                                             |
+-----+-----------+--------+--------+--------+----------+----------+------+
|SGM  |Throughput |Packet  |Conn.   |Concu.  |Accel.    |Instances |Mem.  |
|ID   |           |Rate    |Rate    |Conn    |Cores%    |Cores%    |Usage%|
+-----+-----------+--------+--------+--------+----------+----------+------+
|1_01 |10.2 K     |11      |0       |22      |6/6/6     |5/4/9     |55%   |
+-----+-----------+--------+--------+--------+----------+----------+------+
|Total|10.2 K     |11      |0       |22      |6/6/6     |5/4/9     |55%   |
+-----+-----------+--------+--------+--------+----------+----------+------+
 
+-----------------------------------+
|Per VS CPU Usage Summary           |
+-----+---------+---------+---------+
|VS ID|Avg. Cpu%|Min. Cpu%|Max. Cpu%|
|     |         |(SGM id) |(SGM id) |
+-----+---------+---------+---------+
| 0   |2        |1  (1_02)|2  (1_01)|
| 1   |0        |0  (1_01)|0  (1_04)|
+-----+---------+---------+---------+
* CPU stats is aggregated over the last 24hrs
[Global] MyChassis-ch01-01>

Make sure that resource control monitoring is enabled on all Security Group Members.

To enable resource control monitoring, in the Expert mode run:

# g_fw vsx resctrl monitor enable

By default, absolute values are shown.

Notes:

  • Average, minimum and maximum values are calculated across all active Security Group Members.

  • The Security Group Member ID with the minimum and maximum value shows in brackets for each Security Group Member.

  • Unless otherwise specified, the combined statistics for both IPv4 and IPv6 are shown.

  • When no Security Group Members are specified, performance statistics are shown for the active Security Group Member only.

This example shows peak values for one Virtual System.

[Expert@MyChassis-ch01-01:0]# gclish
[Global] MyChassis-ch01-01> asg perf -vs 0-1 -p
Aggregated statistics (IPv4 and IPv6) of SGMs: all Virtual Systems: 0-1
+-------------------------------------------------------------------------+
|Performance Summary                                                      |
+--------------------------------------------+---------------+------------+
|Name                                        |Value          |IPv4%       |
+--------------------------------------------+---------------+------------+
|Throughput                                  |1.7 K          |100%        |
|Packet rate                                 |2              |100%        |
|Connection rate                             |0              |N/A         |
|Concurrent connections                      |20             |100%        |
|Load average                                |6%             |            |
|Acceleration load (avg/min/max)             |5%/5%/5%       |            |
|Instances load (avg/min/max)                |5%/3%/10%      |            |
|Memory usage                                |57%            |            |
+--------------------------------------------+---------------+------------+
=+------------------------------------------------------------------------+
|Per Path Distribution Summary                                            |
+------------------+------------+--------------+--------------+-----------+
|                  |Acceleration|Medium        |Firewall      |Dropped    |
+------------------+------------+--------------+--------------+-----------+
|Throughput        |0           |0             |1.7 K         |0          |
|Packet rate       |0           |0             |2             |0          |
|Connection rate   |0           |0             |0             |           |
|Concurrent conn.  |10          |0             |10            |           |
+------------------+------------+--------------+--------------+-----------+
[Global] MyChassis-ch01-01>

This example shows detailed performance information for each Security Group Member and traffic distribution between different paths. It also shows VPN throughput and connections.

[Expert@MyChassis-ch01-01:0]# gclish
[Global] MyChassis-ch01-01> asg perf -p -v
Tue Oct 22 07:31:31 IST 2013
Aggregated statistics (IPv4 and IPv6) of SGMs: chassis_active Virtual Systems: 0
+-------------------------------------------------------------+
|Performance Summary                                          |
+----------------------------------------+--------------------+
|Name                                    |Value               |
+----------------------------------------+--------------------+
|Throughput                              |3.3 G               |
|Packet rate                             |6.2 M               |
|Connection rate                         |0                   |
|Concurrent connections                  |3.4 K               |
|Load average                            |54%                 |
|Acceleration load (avg/min/max)         |58%/48%/68%         |
|Instances load (avg/min/max)            |3%/1%/5%            |
|Memory usage                            |18%                 |
+----------------------------------------+--------------------+
 
+---------------------------------------------------------------------------------------+
|Per SGM Distribution Summary                                                           |
+-------+------------+------------+-----+-----------+-------------+--------------+------+
|SGM ID |Throughput  |Packet rate |Conn.|Concurrent |Core usage   |Core Instances|Memory|
|       |            |            |Rate |Connections|avg/min/max %|avg/min/max % |Usage |
+-------+------------+------------+-----+-----------+-------------+--------------+------+
|1_01   |644.3 M     |1.2 M       |0    |520        |52/44/62     |6/3/10        |18%   |
|1_02   |526.7 M     |997.1 K     |0    |512        |61/51/68     |2/0/5         |18%   |
|1_03   |526.6 M     |997.0 K     |0    |512        |62/53/73     |2/1/3         |18%   |
|1_04   |526.7 M     |997.0 K     |0    |804        |54/48/60     |2/1/3         |18%   |
|1_05   |526.7 M     |997.1 K     |0    |512        |59/45/76     |3/1/5         |18%   |
|1_06   |526.7 M     |997.1 K     |0    |512        |61/52/70     |4/4/5         |18%   |
+-------+------------+------------+-----+-----------+-------------+--------------+------+
|Total  |3.3 G       |6.2 M       |0    |3.4 K      |58/48/68     |3/1/5         |18%   |
+-------+------------+------------+-----+-----------+-------------+--------------+------+
 
+-----------------------------------------------------------------------------------+
|Per Path Distribution Summary                                                      |
+-------------------------+------------+------------+------------+------------------+
|                         |Acceleration|Medium      |Firewall    |Dropped           |
+-------------------------+------------+------------+------------+------------------+
|Throughput               |3.2 G       |0           |2.1 M       |117.6 M           |
|Packet rate              |6.0 M       |0           |1.4 K       |222.8 K           |
|Connection rate          |0           |0           |0           |                  |
|Concurrent connections   |3.2 K       |0           |156         |                  |
+-------------------------+------------+------------+------------+------------------+
 
+----------------------------------------+--------------------+
|VPN Performance                                              |
+----------------------------------------+--------------------+
|VPN throughput                          |2.9 G               |
|VPN connections                         |3.1 K               |
+----------------------------------------+--------------------+
[Global] MyChassis-ch01-01>

The -vv mem parameter shows memory usage for each Virtual System across all Active Security Group Members.

[Expert@MyChassis-ch01-01:0]# gclish
[Global] MyChassis-ch01-01> asg perf -vs all -vv mem
Tue Jul 29 16:05:44 IDT 2014
Aggregated statistics (IPv4 Only) of SGMs: chassis_active VSs: all
+--------------------------------------------------------------+
|Performance Summary                                           |
+----------------------------------------------+---------------+
|Name                                          |Value          |
+----------------------------------------------+---------------+
|Throughput                                    |684.5 K        |
|Packet rate                                   |700            |
|Connection rate                               |3              |
|Concurrent connections                        |144            |
|Load average                                  |2%             |
|Acceleration load (avg/min/max)               |0%/0%/1%       |
|Instances load (avg/min/max)                  |2%/0%/12%      |
|Memory usage                                  |10%            |
+----------------------------------------------+---------------+
 * Instances / Acceleration Cores: 8 / 4
+--------------------------------------------------------------------------+
|Per VS Memory Summary                                                     |
+--------+-------------+-------------+-------------+-------------+---------+
| VS ID  | User Space  | Memory in   | FWK memory  | Total memory| CPU     |
|        | memory      | Kernel      |             |             | Usage % |
+--------+-------------+-------------+-------------+-------------+---------+
|   0 max|222.3M (1_01)|1.658G (1_04)|47.11M (1_04)|1.880G (1_04)|   N/A   |
|     min|215.8M (1_03)|1.213G (1_01)|45.55M (1_03)|1.249G (1_01)|   N/A   |
+--------+-------------+-------------+-------------+-------------+---------+
|   1 max|56.34M (1_02)|   0K (1_04) |31.16M (1_02)|56.34M (1_02)|   N/A   |
|     min|54.24M (1_01)|   0K (1_04) |29.52M (1_03)|54.24M (1_01)|   N/A   |
+--------+-------------+-------------+-------------+-------------+---------+
* Maximum and minimum values are calculated across all active SGMs
[Global] MyChassis-ch01-01>

Notes:

  • The Security Group Member that uses the most user space memory on Virtual System 1 is Security Group Member 1_01

  • The Security Group Member that uses the least fwk daemon memory on Virtual System 3 is Security Group Member 1_02

  • This information shows only if vsxmstat is enabled for perfanalyze use

  • Make sure that the vsxmstat feature is enabled (vsxmstat status_raw)