Kernel Debug Procedure with Connection Life Cycle
Introduction
Connection Life Cycle is a debug tool.
This tool generates a formatted debug output file (in the Ruby format) that presents the debug messages hierarchically by connections and packets:
-
The first hierarchy level shows connections.
-
After you expand the connection, you see all the packets of this connection.
|
Important - You must use this tool in the Expert mode together with the regular kernel debug flags (see Kernel Debug Modules and Debug Flags). |
Syntax for a Security Gateway / each Cluster Member
-
To start the debug capture:
conn_life_cycle.sh -a start -o /<Path>/<Name of Raw Debug Output File> [{-t | -T}] [[-f "<Filter1>"] [-f "<Filter2>"] [-f "<Filter3>] [-f "<Filter4>] [-f "<Filter5>"]]
-
To stop the debug capture and prepare the formatted debug output:
conn_life_cycle.sh -a stop -o /<Path>/<Name of Formatted Debug Output File>
Syntax for a Scalable Platform Security Group
-
To start the debug capture:
g_all conn_life_cycle.sh -a start -o /<Path>/<Name of Raw Debug Output File> [{-t | -T}] [[-f "<Filter1>"] [-f "<Filter2>"] [-f "<Filter3>] [-f "<Filter4>] [-f "<Filter5>"]]
-
To stop the debug capture and prepare the formatted debug output:
g_all conn_life_cycle.sh -a stop -o /<Path>/<Name of Formatted Debug Output File>
Parameters
Parameter |
Description |
||||
---|---|---|---|---|---|
|
Mandatory. Specifies the action:
|
||||
|
Optional. Specifies the resolution of a time stamp in front of each debug message:
|
||||
|
Optional. Specifies which connections and packets to capture. For additional information, see Kernel Debug Filters.
Each filter must contain these five numbers (5-tuple) separated with commas:
Example of capturing traffic from IP 192.168.20.30 from any port to IP 172.16.40.50 to port 22 over the TCP protocol:
|
||||
|
|
||||
|
Mandatory. Specifies the absolute path and the name of the raw debug output file. Example:
|
||||
|
Mandatory. Specifies the absolute path and the name of the formatted debug output file (to analyze by an administrator). Example:
|
Procedure
|
Important - In cluster |
-
Connect to the command line on your Security Gateway / each Cluster Member / Scalable Platform Security Group
Use an SSH or a console connection.
Best Practice - Use a console connection.
Notes for Scalable Platforms:
-
If you connect over a serial console, you must connect to the Security Group Member that runs as the SMO (Single Management Object
Single Security Gateway object in SmartConsole that represents a Security Group configured on a Quantum Maestro Orchestrator / Scalable Chassis. Acronym: SMO.).
-
Enable the applicable debug flags in the applicable kernel modules
-
On the Security Gateway
Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. / each Cluster Member
Security Gateway that is part of a cluster., run:
fw ctl debug -m <module> {all | + <flags>}
-
On the Scalable Platform Security Group, run:
g_fw ctl debug -m <module> {all | + <flags>}
-
-
Examine the list of the debug flags that are enabled in the specified kernel modules
-
On the Security Gateway / each Cluster Member, run:
fw ctl debug -m <module>
-
On the Scalable Platform Security Group, run:
g_fw ctl debug -m <module>
-
-
Start the debug capture
-
On the Security Gateway / each Cluster Member, run:
conn_life_cycle.sh -a start -o /var/log/kernel_debug.txt -T -f "<Filter1>" [... [-f "<FilterN>"]]
-
On the Scalable Platform Security Group, run:
g_all conn_life_cycle.sh -a start -o /var/log/kernel_debug.txt -T -f "<Filter1>" [... [-f "<FilterN>"]]
-
-
Replicate the issue, or wait for the issue to occur
Replicate the issue if you know how, or wait for the issue to occur.
-
Stop the debug capture and prepare the formatted debug output
-
On the Security Gateway / each Cluster Member, run:
conn_life_cycle.sh -a stop -o /var/log/kernel_debug_formatted.txt
-
On the Scalable Platform Security Group, run:
g_all conn_life_cycle.sh -a stop -o /var/log/kernel_debug_formatted.txt
-
-
Transfer the output file to your computer
Transfer this file from the Security Gateway / each Cluster Member / each Security Group Member to your computer:
/var/log/kernel_debug.txt
Best Practice - Compress this file with the "
tar -zxvf
" command and transfer it from the Security Gateway / each Cluster Member / each Security Group Members to your computer. If you transfer to an FTP server, do so in the binary mode. -
Analyze the output file on your computer
Examine the formatted debug output file in an advanced text editor like Notepad++ (click Language > R > Ruby), or any other Ruby language viewer.
Example
![Closed](transparent.gif)
Everything is collapsed:
Opened the first hierarchy level to see the connection:
Opened the second hierarchy level to see the packets of this connection: