SecureXL Debug Procedure

By default, SecureXL writes the output debug information to the /var/log/messages file.

To collect the applicable SecureXL debug and to make its analysis easier, follow the steps below.

Note - For more information, see the R81 Quantum Security Gateway Guide - Chapter Kernel Debug on Security Gateway.

Important:

  • We strongly recommend to schedule a full maintenance window to minimize the impact on your production traffic.

  • We strongly recommend to connect over serial console to your Security Gateway.

    This is to avoid a possible issue when you cannot work with the CLI because of a high load on the CPU.

  • In cluster, you must collect this debug from all Cluster Members in the same way.

  • Debug the specific SecureXL instance only when you are sure that only that SecureXL instance processes the traffic.

Procedure

  1. Use an SSH or a console connection.

    Best Practice - Use a console connection.

  2. If the default shell is Gaia Clish, then run:

    expert

  3. Run:

    fw ctl debug 0

    • For all SecureXL instances, run:

      fwaccel dbg resetall

    • For a specific SecureXL instance, run:

      fwaccel -i <SecureXL ID> dbg resetall

  5. Run:

    fw ctl debug -buf 8200 [-v {"<List of VSIDs>" | all}]

    Note - The optional part "-v {"<List of VSIDs>" | all}" is to specify the applicable Virtual Systems on a VSX Gateway or VSX Cluster Member.

  6. Run:

    fw ctl debug | grep buffer

  7. Run:

    fw ctl debug -m <Name of Kernel Debug Module> {all | + <Kernel Debug Flags>}

    • For all SecureXL instances, run:

      fwaccel dbg -m <Name of SecureXL Debug Module> {all | + <SecureXL Debug Flags>}

    • For a specific SecureXL instance, run:

      fwaccel -i <SecureXL ID> dbg -m <Name of SecureXL Debug Module> {all | + <SecureXL Debug Flags>}

    See SecureXL Debug Modules and Debug Flags.

  9. Run:

    fw ctl debug

    • For all SecureXL instances, run:

      fwaccel dbg list

    • For a specific SecureXL instance, run:

      fwaccel -i <SecureXL ID> dbg list

  11. Run:

    fw tab -t connections -x -y

    Important:

    • This step makes sure that you collect the debug of the real issue that is not affected by the existing connections.

    • This command deletes all existing connections. This interrupts all connections, including the SSH.

      Run this command only if you are connected over a serial console to your Security Gateway.

  12. Run:

    fw tab -t cphwd_tmpl -x -y

    Note - This command does not interrupt the existing connections. This step makes sure that you collect the debug of the real issue that is not affected by the existing connection templates.

  13. Run:

    fw ctl kdebug -T -f > /var/log/kernel_debug.txt

  14. Perform the steps that cause the issue to occur, or wait for it to occur.

  15. Press CTRL+C.

  16. Run:

    fw ctl debug 0

    • For all SecureXL instances, run:

      fwaccel dbg resetall

    • For a specific SecureXL instance, run:

      fwaccel -i <SecureXL ID> dbg resetall

  18. Run:

    fw ctl debug

    • For all SecureXL instances, run:

      fwaccel dbg list

    • For a specific SecureXL instance, run:

      fwaccel -i <SecureXL ID> dbg list

  20. Path to the debug output file:

    /var/log/kernel_debug.txt

    Best Practice - Compress this file with the "tar -zxvf" command and transfer it from the Security Gateway to your computer. If you transfer to an FTP server, do so in the binary mode.