Running the 'fw ctl affinity -l' command in VSX Mode

Description

The fw ctl affinity -l command shows the CoreXL Performance-enhancing technology for Security Gateways on multi-core processing platforms. Multiple Check Point Firewall instances are running in parallel on multiple CPU cores. affinity The assignment of a specified CoreXL Firewall instance, VSX Virtual System, interface, user space process, or IRQ to one or more specified CPU cores. settings on a VSX Gateway Physical server that hosts VSX virtual networks, including all Virtual Devices that provide the functionality of physical network devices. It holds at least one Virtual System, which is called VS0. for:

Interfaces
User-space processes
CoreXL Firewall instances

Note - Before running the fw ctl affinity -l -x commands, you must go to the context of the applicable Virtual System or Virtual Router with the Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell). command set virtual-system <VSID>.

Syntax

To show the affinities in VSX mode (you can combine the optional parameters):

fw ctl affinity -l -x

[-vsid <VSID ranges>]

[-cpu <CPU ID ranges>]

[-flags {e | k | t | n | h | o}]

To show the number of system CPU cores allowed by the installed CoreXL license:

fw -d ctl affinity -corelicnum

Parameters

Parameter

Description

-vsid <VSID ranges>

Shows the affinity for:

The specified single Virtual System (for example, -vsid 7)
The specified several Virtual Systems (for example, -vsid 0-2 4)

Important - If you omit the -vsid parameter, the command runs in the current virtual context.

<CPU ID ranges>

Shows the affinity for:

The specified single CPU (for example, -cpu 7)
The specified several CPU cores (for example, -cpu 0-2 4)

-flags {e | k | t | n | h | o}

The -flags parameter requires at least one of these arguments:

e - Do not print the exception processes
k - Do not print the kernel threads
t - Print all process threads
n - Print the process name instead of the /proc/<PID> /cmdline
h - Print the CPU mask in Hex format
o - Print the output into the file called /tmp/affinity_list_output

Important - You must specify multiple arguments together. For example: -flags tn

Example 1

[Expert@VSX_GW:0]# fw ctl affinity -l -x -cpu 0
---------------------------------------------------------------------
|PID     |VSID |               CPU                    |SRC|V|KT |EXC| NAME
---------------------------------------------------------------------
|      2 |   0 |                                    0 |   | | K |   |
|      3 |   0 |                                    0 |   | | K |   |
|      4 |   0 |                                    0 |   | | K |   |
|     14 |   0 |                                    0 |   | | K |   |
|     99 |   0 |                                    0 |   | | K |   |
|    278 |   0 |                                    0 |   | | K |   |
|    382 |   0 |                                    0 |   | | K |   |
|    674 |   0 |                                    0 |   | | K |   |
|   2195 |   0 |                                    0 |   | | K |   |
|   6348 |   0 |                                    0 |   | | K |   |
|   6378 |   0 |                                    0 |   | | K |   |
---------------------------------------------------------------------
PID   - represents the pid of the process
VSID  - represents the virtual device id
CPU   - represents the CPUs assigned to the specific process
SRC   - represents the source configuration file of the process - (V)SID / (I)nstance / (P)rocess
V     - represents validity,star means that the actual affinity is different than the configured affinity
KT    - represents whether the process is a kernel thread
EXC   - represents whether the process belongs to the process exception list (vsaffinity_exception.conf)
[Expert@VSX_GW:0]#

Example 2

[Expert@VSX_GW:0]# fw ctl affinity -l -x -vsid 1
---------------------------------------------------------------------
|PID     |VSID |               CPU                    |SRC|V|KT |EXC| NAME
---------------------------------------------------------------------
|   3593 |   1 |                                1 2 3 |   | |   |   | httpd
|  10997 |   1 |                                1 2 3 |   | |   |   | cvpn_rotatelogs
|  11005 |   1 |                                1 2 3 |   | |   |   | httpd
|  22294 |   1 |                                1 2 3 |   | |   |   | routed
|  22328 |   1 |                                1 2 3 |   | |   |   | fwk_wd
|  22333 |   1 |                                1 2 3 | P | |   |   | fwk
|  22488 |   1 |                                1 2 3 |   | |   |   | cpd
|  22492 |   1 |                                1 2 3 |   | |   |   | fwd
|  22504 |   1 |                                1 2 3 |   | |   |   | cpviewd
|  22525 |   1 |                                1 2 3 |   | |   |   | mpdaemon
|  22527 |   1 |                                1 2 3 |   | |   |   | ci_http_server
|  30629 |   1 |                                1 2 3 |   | |   |   | vpnd
|  30631 |   1 |                                1 2 3 |   | |   |   | pdpd
|  30632 |   1 |                                1 2 3 |   | |   |   | pepd
|  30635 |   1 |                                1 2 3 |   | |   |   | fwpushd
|  30743 |   1 |                                1 2 3 |   | |   |   | dbwriter
|  30748 |   1 |                                1 2 3 |   | |   |   | cvpnproc
|  30752 |   1 |                                1 2 3 |   | |   |   | MoveFileServer
|  30756 |   1 |                                1 2 3 |   | |   |   | CvpnUMD
|  30760 |   1 |                                1 2 3 |   | |   |   | Pinger
|  30764 |   1 |                                1 2 3 |   | |   |   | IdlePinger
|  30770 |   1 |                                1 2 3 |   | |   |   | cvpnd
---------------------------------------------------------------------
[Expert@VSX_GW:0]#