Support Center > Search Results > SecureKnowledge Details
ClusterXL Sync Statistics - output of 'fw ctl pstat' command
Solution

Refer to ClusterXL Administration Guide (R55, R60, R61, R62, R65, R70, R70.1, R71, R75, R75.20, R75.40, R75.40VS, R76, R77) - Chapter 'Monitoring and Troubleshooting Gateway Clusters' - Monitoring Synchronization (fw ctl pstat).

Example of the 'Sync' section in the output of 'fw ctl pstat' command:

 
Sync: 
	Version: new 
	Status: Able to Send/Receive sync packets 
	Sync packets sent: 
	 total : 466729198, retransmitted :241305, retrans reqs : 6089, acks : 809 
	Sync packets received: 
	 total : 77283541, were queued : 6715, dropped by net : 6079 
	 retrans reqs : 37462, received 221 acks 
	 retrans reqs for illegal seq : 2 
	 dropped updates as a result of sync overload: 3
	Delta Sync memory usage: currently using XX KB mem 
	Callback statistics: handled 165 cb, average delay : 3, max delay : 34 
	Number of Pending packets currently held: 1 
	Packets released due to timeout: 18

 

Output section Explanation
Sync: off
Delta Sync is disabled:

  • Full Sync failed (refer to the output of 'cphaprob -ia list' command - check the state of 'Synchronization' pnote)

  • Delta Sync was disabled by cluster administrator (the box 'Use State Synchronization' was not checked in cluster object, or ran the 'fw ctl setsync off' command)

  • Sync interface was removed from cluster configuration (refer to the output of 'cphaprob -a if' command)
Sync:
Live connections update: on
'Active Mode' tab is opened in SmartView Tracker. Refer to sk30908.
Sync:
	Version: old
Check Point FW-1 v4.1 and lower.
Sync:
	Version: new
Check Point FW-1 NG and above.
Sync:
	Version: new
	Status: Able to Send/Receive sync packets
Delta Sync works correctly.
Sync:
	Version: new
	Status:
	Able to send sync packets
	Unable to receive sync packets
or
Sync:
	Version: new
	Status:
	Unable to send sync packets
	Unable to receive sync packets
The problem is described in the output itself (requires cluster debugging).
Sync:
	Version: new
	Status:
	Able to send sync packets
	Saving incoming sync packets
or
Sync:
	Version: new
	Status:
	Unable to send sync packets
	Saving incoming sync packets
The problem is described in the output itself (requires cluster debugging).
Sync:
	Version: new
	Status:
	Able to send sync packets
	Able to receive sync packets
or
Sync:
	Version: new
	Status:
	Unable to send sync packets
	Able to receive sync packets
The problem is described in the output itself (requires cluster debugging).
Sync packets sent: 
 total : 466729198, retransmitted :241305, retrans reqs : 6089, acks : 809
  • TOTAL number of sync packets is non-zero and increasing.
  • RETRANS REQS may increase under load.
Sync packets received: 
 total : 77283541, were queued : 6715, dropped by net : 6079
 retrans reqs : 37462, received 221 acks 
 retrans reqs for illegal seq : 2 
 dropped updates as a result of sync overload: 3  
  • TOTAL number of sync packets is non-zero and increasing.
  • QUEUED value never decreases - a non-zero value does not indicate a problem.
  • DROPPED BY NET number may indicate network congestion - this counter is incremented when the cluster member receives a sync packet with a sequence number, which is higher, than the expected sequence number; meaning, packets with lower sequence numbers where lost somewhere along the way, and we should find out where.
  • RETRANS REQS growing very fast may indicate that the load is becoming too high.
  • RETRANS REQS FOR ILLEGAL SEQ may indicate a sync problem.
  • DROPPED UPDATES AS A RESULT OF SYNC OVERLOAD - in a heavily loaded system, the cluster member may drop synchronization updates sent from peer cluster member.
Delta Sync memory usage: currently using XX KB mem
This statistic only appears for a non-zero value. It requires memory only while Full Sync is occurring. At other times, Delta Sync requires no memory.
Callback statistics: handled 138 cb, average delay : 2, max delay : 34
This statistic only appears for a non-zero value. AVERAGE DELAY should be ~1-5 packets, otherwise indicates an overload of sync traffic.
Number of Pending packets currently held: 1
This statistic only appears for a non-zero value.
Packets released due to timeout: 18
This statistic only appears for a non-zero value. If the number is large (more than 100 pending packets), and the "Number of Pending packets currently held" is small in the output of 'cphaprob syncstat' command, you should take action to reduce the number of pending packets. To tackle this problem, see "Reducing the Number of Pending Packets" in ClusterXL Administration Guide.

 

Related Solutions:

Give us Feedback
Please rate this document
[1=Worst,5=Best]
Comment