fw ctl leak

Description

Generates leak detection reportClosed Summary of network activity and Security Policy enforcement that is generated by Check Point products, such as SmartEvent.. This report is for Check Point use only.

Important - This command save the report into the activeClosed State of a Cluster Member that is fully operational: (1) In ClusterXL, this applies to the state of the Security Gateway component (2) In 3rd-party / OPSEC cluster, this applies to the state of the cluster State Synchronization mechanism. /var/log/messages file and the dmesg buffer.

Syntax

fw [-d] ctl leak

      {-h | -help}

      [{-a | -A}] [-t <Internal Object Type>] [-o <Internal Object ID>]

            [-d] [-l] [-p]

            [-s]

Parameters

Parameter

Description

fw -d ctl leak ...

Runs the command in debug mode.

Use only if you troubleshoot the command itself.

Best Practice - If you use this parameter, then redirect the output to a file, or use the script command to save the entire CLI session.

{-h | -help}

Shows the built-in help.

-a

Specifies to perform leak detection for potential leaks.

This parameter is mutually exclusive with the parameter "-A".

-A

Specifies to perform leak detection for all leaks.

This parameter is mutually exclusive with the parameter "-a".

-d

Dumps object data.

This parameter is mutually exclusive with the parameter "-s".

-l

Prints the action log.

This parameter is mutually exclusive with the parameter "-s".

-o <Internal Object ID>

Specifies to perform leak detection for the specified internal object ID.

-p

Purges the internal objects from the lists.

This parameter is mutually exclusive with the parameter "-s".

-s

Shows summary only.

This parameter is mutually exclusive with the parameters "-d", "-l", and "-p".

-t <Internal Object Type>

Specifies the internal object types, for which to perform leak detection.

Available internal object types are:

  • chain

  • connh

  • cookie

  • kbuf

  • num

If you do not specify the internal object type explicitly, the command performs leak detection for all internal object types.

Procedure

Step

Instructions

1

Connect to the command line on the Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources..

2

Log in to the Expert mode.

3

Back up the current /var/log/messages file:

[Expert@GW_HostName:0]# cp -v /var/log/messages{,_BKP}

4

Delete the information from the current /var/log/messages file:

[Expert@GW_HostName:0]# echo '' > /var/log/messages

5

Delete the information from the current dmesg buffer:

[Expert@GW_HostName:0]# dmesg -c

6

Generate the leak detection report (see the Syntax section above):

[Expert@GW_HostName:0]# fw [-d] ctl leak <options>

7

Make sure the command generated the leak detection report:

[Expert@GW_HostName:0]# dmesg

[Expert@GW_HostName:0]# cat /var/log/messages

8

Collect the leak detection report:

[Expert@GW_HostName:0]# cp -v /var/log/messages{,_LEAK_DETECTION}

9

Analyze the leak detection report:

/var/log/messages_LEAK_DETECTION

Example

[Expert@MyGW:0]# cp -v /var/log/messages{,_BKP}
`/var/log/messages' -> `/var/log/messages_BKP'
[Expert@MyGW:0]#
[Expert@MyGW:0]# echo '' > /var/log/messages
[Expert@MyGW:0]#
[Expert@MyGW:0]# dmesg -c
[Expert@MyGW:0]#
[Expert@MyGW:0]# fw ctl leak -s
[Expert@MyGW:0]#
[Expert@MyGW:0]# dmesg
[fw4_0];fwleak_report: type chain - 0 objects
[fw4_0];fwleak_report: type cookie - 0 objects
[fw4_0];fwleak_report: type kbuf - 0 objects
[fw4_0];fwleak_report: type connh - 0 objects
[fw4_1];fwleak_report: type chain - 0 objects
[fw4_1];fwleak_report: type cookie - 0 objects
[fw4_1];fwleak_report: type kbuf - 0 objects
[fw4_1];fwleak_report: type connh - 0 objects
[fw4_2];fwleak_report: type chain - 0 objects
[fw4_2];fwleak_report: type cookie - 0 objects
[fw4_2];fwleak_report: type kbuf - 0 objects
[fw4_2];fwleak_report: type connh - 0 objects
[Expert@MyGW:0]#
[Expert@MyGW:0]# cat /var/log/messages
Sep 12 16:09:50 2019 MyGW kernel: [fw4_0];fwleak_report: type chain - 0 objects
Sep 12 16:09:50 2019 MyGW kernel: [fw4_0];fwleak_report: type cookie - 0 objects
Sep 12 16:09:50 2019 MyGW kernel: [fw4_0];fwleak_report: type kbuf - 0 objects
Sep 12 16:09:50 2019 MyGW kernel: [fw4_0];fwleak_report: type connh - 0 objects
Sep 12 16:09:50 2019 MyGW kernel: [fw4_1];fwleak_report: type chain - 0 objects
Sep 12 16:09:50 2019 MyGW kernel: [fw4_1];fwleak_report: type cookie - 0 objects
Sep 12 16:09:50 2019 MyGW kernel: [fw4_1];fwleak_report: type kbuf - 0 objects
Sep 12 16:09:50 2019 MyGW kernel: [fw4_1];fwleak_report: type connh - 0 objects
Sep 12 16:09:50 2019 MyGW kernel: [fw4_2];fwleak_report: type chain - 0 objects
Sep 12 16:09:50 2019 MyGW kernel: [fw4_2];fwleak_report: type cookie - 0 objects
Sep 12 16:09:50 2019 MyGW kernel: [fw4_2];fwleak_report: type kbuf - 0 objects
Sep 12 16:09:50 2019 MyGW kernel: [fw4_2];fwleak_report: type connh - 0 objects
[Expert@MyGW:0]
[Expert@MyGW:0]# cp -v /var/log/messages{,_LEAK_DETECTION}
`/var/log/messages' -> `/var/log/messages_LEAK_DETECTION'
[Expert@MyGW:0]#