Kernel Debug Procedure with Connection Life Cycle

Introduction

Connection Life Cycle is a debug tool.

This tool generates a formatted debug output file (in the Ruby format) that presents the debug messages hierarchically by connections and packets:

• The first hierarchy level shows connections.

• After you expand the connection, you see all the packets of this connection.

Syntax for a Security Gateway / each Cluster Member

• To start the debug capture:

  conn_life_cycle.sh -a start -o /<Path>/<Name of Raw Debug Output File> [{-t | -T}] [[-f "<Filter1>"] [-f "<Filter2>"] [-f "<Filter3>] [-f "<Filter4>] [-f "<Filter5>"]]

• To stop the debug capture and prepare the formatted debug output:

  conn_life_cycle.sh -a stop -o /<Path>/<Name of Formatted Debug Output File>

Syntax for a Scalable Platform Security Group

• To start the debug capture:

  g_all conn_life_cycle.sh -a start -o /<Path>/<Name of Raw Debug Output File> [{-t | -T}] [[-f "<Filter1>"] [-f "<Filter2>"] [-f "<Filter3>] [-f "<Filter4>] [-f "<Filter5>"]]

• To stop the debug capture and prepare the formatted debug output:

  g_all conn_life_cycle.sh -a stop -o /<Path>/<Name of Formatted Debug Output File>

Procedure

1. Connect to the command line on your Security Gateway / each Cluster Member / Scalable Platform Security Group

   Use an SSH or a console connection.

   Best Practice - Use a console connection.

   Notes for Scalable Platforms: If you connect over SSH, you must connect to the applicable Security Group A logical group of Security Appliances (in Maestro) / Security Gateway Modules (on Scalable Chassis) that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances / Security Gateway Modules. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. In Maestro, each Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected.. If you connect over a serial console, you must connect to the Security Group Member Member of a Security Group in ElasticXL Cluster, Maestro, and Scalable Chassis. Acronym: SGM. that runs as the SMO (Single Management Object Single Security Gateway object in SmartConsole that represents a Security Group configured on a Quantum Maestro Orchestrator / Scalable Chassis. Acronym: SMO.).

2. Log in to the Expert mode

   If the default shell is Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)., run:

   expert

3. Enable the applicable debug flags in the applicable kernel modules

   • On the Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. / each Cluster Member Security Gateway that is part of a cluster., run:

     fw ctl debug -m <module> {all | + <flags>}

   • On the Scalable Platform Security Group, run:

     g_fw ctl debug -m <module> {all | + <flags>}

4. Examine the list of the debug flags that are enabled in the specified kernel modules

   • On the Security Gateway / each Cluster Member, run:

     fw ctl debug -m <module>

   • On the Scalable Platform Security Group, run:

     g_fw ctl debug -m <module>

5. Start the debug capture

   • On the Security Gateway / each Cluster Member, run:

     conn_life_cycle.sh -a start -o /var/log/kernel_debug.txt -T -f "<Filter1>" [... [-f "<FilterN>"]]

   • On the Scalable Platform Security Group, run:

     g_all conn_life_cycle.sh -a start -o /var/log/kernel_debug.txt -T -f "<Filter1>" [... [-f "<FilterN>"]]

6. Replicate the issue, or wait for the issue to occur

   Replicate the issue if you know how, or wait for the issue to occur.

7. Stop the debug capture and prepare the formatted debug output

   • On the Security Gateway / each Cluster Member, run:

     conn_life_cycle.sh -a stop -o /var/log/kernel_debug_formatted.txt

   • On the Scalable Platform Security Group, run:

     g_all conn_life_cycle.sh -a stop -o /var/log/kernel_debug_formatted.txt

8. Transfer the output file to your computer

   Transfer this file from the Security Gateway / each Cluster Member / each Security Group Member to your computer:

   /var/log/kernel_debug.txt

   Best Practice - Compress this file with the "tar -zxvf" command and transfer it from the Security Gateway / each Cluster Member / each Security Group Members to your computer. If you transfer to an FTP server, do so in the binary mode.

9. Analyze the output file on your computer

   Examine the formatted debug output file in an advanced text editor like Notepad++ (click Language > R > Ruby), or any other Ruby language viewer.