Performance Hogs (asg_perf_hogs)

You can run tests to check for software components that decrease (hog) performance.

Syntax

Description

You can run:

The "asg_perf_hogs" command in the Expert mode
The "show smo verifiers report name Performance_hogs" command in Gaia gClish The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators. Commands you run in this shell apply to all Security Appliances in the Security Group.

Notes:

When you run the "asg_perf_hogs" command by itself, you can get the full details of all the tests it runs.
When you run the "show smo verifiers report name Performance_hogs" command, it shows a general result of "asg_perf_hogs" test output.
If all of the "asg_perf_hogs" tests pass, the "show smo verifiers report name Performance_hogs" command shows Passed.
If even one of the "asg_perf_hogs" tests fails, the "show smo verifiers report name Performance_hogs" command shows Failed (!).

Syntax

asg_perf_hogs

Example

[Expert@MyChassis-ch0x-0x:0]# asg_perf_hogs

-----------------------------------------------------------------

|  Status  |  Test performed                                    |

-----------------------------------------------------------------

| [PASSED] | Disabled Accept Templates                          |

| [PASSED] | Disabled NAT Templates                             |

| [PASSED] | FW1 debug flags                                    |

| [PASSED] | Kernel soft lockups                                |

| [PASSED] | Local logging                                      |

| [PASSED] | Long running processes                             |

| [PASSED] | Neighbour table overflow                           |

| [PASSED] | PPACK debug flags                                  |

| [PASSED] | Routing cache entries                              |

| [PASSED] | SecureXL status                                    |

| [PASSED] | Swap saturation                                    |

| [FAILED] | routed trace options                               |

-----------------------------------------------------------------

Found the following issues:

-----------------------------------------------------------------

[ All] routed trace options are set: Cluster; igmp:All; pim:All

[Expert@MyChassis-ch0x-0x:0]#

Configuration

Configure the "asg_perf_hogs" behavior in the $SMODIR/conf/performance_hogs.conf file.

[tests]
long_running_procs=1
accel_off=1
sim_debug_flags=1
fw1_debug_flags=1
local_logging=1
disabled_templates=1
correction_table_entries=1
routing_cache_entries=1
swap_saturation=1
delayed_notifications=1
neighbour_table_overflow=1
soft_lockups=1
standby_chassis_load=1
routed_trace_options=1
peak_connections=1

[correction_table_entries]
threshold=10

[long_running_procs]
elapsed_time=60
processes_to_check=("fw ctl zdebug" "fw ctl debug" "fw ctl kdebug" "fw monitor" "tcpdump")

[routing_cache_entries]
threshold=90

[swap_saturation]
threshold=50

[neighbour_table_overflow]
timeout=3600

[soft_lockups]
timeout=3600

[standby_chassis_load]
threshold=50

[peak_connections]
threshold=90

[disabled_templates]
#max_rule_num=999

The [tests] Section

In the [tests] section of the $SMODIR/conf/performance_hogs.conf file you enable and disable tests to run.

Note - Not all the tests can be configured.

To enable or disable a test:

In the "[tests]" section, set the applicable value for the applicable test:

To enable the test:

<Test Name>=1

To disable the test:

<Test Name>=0

To configure a test:

Step	Instructions
1	Find the configuration section for the test in the `$SMODIR/conf/performance_hogs.conf` file. If it does not exist, add the section with this format: `[<Test Name>]`
2	Change or add the parameters for the test. See the tables below for allowed parameters.

Step

Instructions

Find the configuration section for the test in the $SMODIR/conf/performance_hogs.conf file.

If it does not exist, add the section with this format:

[<Test Name>]

Change or add the parameters for the test.

See the tables below for allowed parameters.

Below are the descriptions of some of the tests in the "[tests]" section in the $SMODIR/conf/performance_hogs.conf file.

long_running_procs

The "long_running_procs" test confirms that certain processes do not run longer than the configured time.

Note - This test runs in contexts of all Virtual Systems.

Parameters:

Parameter

Description

elapsed_time

Longest time in seconds a process should run

Default: 60 seconds.

Minimum recommended value: 30 seconds.

processes_to_check

List of processes to check:

You must enclose each process in double quotes.

You must enter a space before another test.

Default:

"fw ctl zdebug" "fw ctl debug" "fw ctl kdebug" "fw monitor" "tcpdump"

Example:

processes_to_check=("fw ctl zdebug" "fw ctl debug" "fw ctl kdebug" "fw monitor" "tcpdump")

accel_off

The "accel_off" test confirms that SecureXL Check Point product on a Security Gateway that accelerates IPv4 and IPv6 traffic that passes through a Security Gateway. is working.

Notes:

This test has no configuration options.
The test runs in the context of the current Virtual System only.

fw1_debug_flags

The "fw1_debug_flags" test confirms that Firewall debug flags that are not enabled by default, stay in the disabled position.

Notes:

This test has no configuration options.
This test runs in contexts of all Virtual Systems.

local_logging

The "local_logging" test confirms that logs are written to a Log Server Dedicated Check Point server that runs Check Point software to store and process logs. and not locally.

Notes:

This test has no configuration options.
This test runs in the context of the current Virtual System only.

routing_cache_entries

The "routing_cache_entries" test confirms that the IPv4 route cache capacity is not above a certain threshold.

Threshold is the percent capacity of the IPv4 route cache that should not be exceeded:

Default: 90%.
Recommended range: 75 - 95%.

Note - This test runs in the context of the current Virtual System only.

neighbour_table_overflow

The "neighbour_table_overflow" test confirms that the ARP cache did not overflow.

Timeout is the number of seconds the specifies for how long to look in the /var/log/messages file for ARP cache overloaded messages.

Recommended range: 300 - 86400.

Notes:

To learn how to adjust the ARP cache, see sk43772.
This test runs regardless of the Virtual System context.

soft_lockups

The "soft_lockups" test confirms there are no kernel soft lockups during the timeout period.

Timeout is the number of seconds to look back in the /var/log/messages file for kernel soft lockup messages:

Default: 3600 seconds.
Recommended range: 300 - 86400 seconds.

Note - This test runs regardless of the Virtual System context.