pm

confd

Maintenance window is required to restart this daemon:

• When confd daemon is starting, by design, it restarts any currently running routed daemons (by sending a TERM signal). It is done to avoid possible issues in Gaia Clish (e.g., returning invalid results for routing-related commands like "show route").
• Since routed daemon is responsible for all the routing in Gaia OS, short traffic outage will occur while routed daemon is being restarted.
• Since routed daemon is a Critical Device in Check Point cluster (since R76), cluster fail-over might occur while routed daemon is being restarted (refer to sk92878).

searchd

clishd

clish

routed

Maintenance window is required to restart this daemon:

• Since routed daemon is responsible for all the routing in Gaia OS, short traffic outage will occur while routed daemon is being restarted.
• Since routed daemon is a Critical Device in Check Point cluster (since R76), cluster fail-over might occur while routed daemon is being restarted (refer to sk92878).

httpd2

• /var/log/httpd2_error_log
• /var/log/httpd2_access_log

monitord

rconfd

cloningd

dhcpd

• In Gaia Clish:
  set dhcp server disable
• In Gaia Portal:
  "Network Management" section - "DHCP Server" pane

• In Gaia Clish:
  set dhcp server enable
• In Gaia Portal:
  "Network Management" section - "DHCP Server" pane

snmpd

• In Gaia Clish:
  set snmp agent off
• In Gaia Portal:"System Management" section - "SNMP" pane

• In Gaia Clish:
  set snmp agent on
• In Gaia Portal:
  "System Management" section - "SNMP" pane

xpand

sshd

• /var/log/secure
• /var/log/auth/
• /var/log/messages

• R80.40 Jumbo Hotfix Take 83 and higher versions:
  1. Back up and edit:
     /etc/ssh/templates/sshd_config.templ
  2. Run :
     /bin/sshd_template_xlate < /config/active
• In lower versions:
  /etc/ssh/sshd_config

1. Edit the applicable "sshd_config" file (see above):
   
   1. Change the "LogLevel" line:
      from:
      #LogLevel INFO
      to:
      LogLevel DEBUG3
   2. Save the changes in the file
   3. Load the updated configuration (in R80.40 Jumbo Hotfix Take 83 and higher versions):
      /bin/sshd_template_xlate < /config/active
2. Start SSHD under debug to run in background (copy the PID):
   /usr/sbin/sshd -ddd 1>> /var/log/sshd.debug.txt 2>> /var/log/sshd.debug.txt &
3. Replicate the issue (connect over SSH).
4. Stop the SSHD:
   kill -TERM <PID>
   kill -KILL <PID>
5. Revert the changes in the applicable "sshd_config" file
6. Load the updated configuration (in R80.40 Jumbo Hotfix Take 83 and higher versions):
   /bin/sshd_template_xlate < /config/active
7. Analyze:
   /var/log/sshd.debug.txt

syslogd

• /var/log/messages
• /var/log/dmesg

• /etc/syslog.conf
• /var/run/syslog.conf

DAService

• /opt/CPInstLog/DeploymentAgent.log
• /opt/CPInstLog/DA_UI.log

1. $DADIR/bin/dastop
2. dbget installer:stop

1. $DADIR/bin/dastart
2. dbget installer:start

Refer to sk92449:

1. Create the configuration file:
   touch $DADIR/bin/DAconf
2. Add the following line (case-sensitive; spaces are not allowed):
   PING_TRACE=1
3. Save the changes
4. Re-load the new configuration:
   DAClient conf
5. As soon as possible:
   
   1. Replicate the issue
   2. Delete the $DADIR/bin/DAconf file
   3. Re-load the configuration with DAClient conf command
6. Analyze:
   /opt/CPInstLog/DeploymentAgent.log

AutoUpdater - responsible for automatic updates in:

• R80.40 and higher
• R80.30 Jumbo Take 71 (and higher)
• R80.20 Jumbo Take 117 (and higher)
• R80.10 Jumbo Take 245 (and higher)

cpwd

cpd

• Port 18191 - Generic process (add-ons container) for many Check Point services, such as installing and fetching policy, and online updates
• Port 18211 - SIC push certificate (from Internal CA)

• Management Server / Security Gateway:

  cpwd_admin stop -name CPD -path "$CPDIR/bin/cpd_admin" -command "cpd_admin stop"
  or
  cpstop
  
  

• VSX Gateway:

  [Expert@HostName:0]# vsenv <VSID>
  [Expert@HostName:<VSID>]# cpwd_admin stop -name CPD -ctx <VSID> -path "$CPDIR/bin/cpd_admin" -command "cpd_admin stop" -env inherit
  or
  [Expert@HostName:0]# cpstop

• Management Server / Security Gateway:

  cpwd_admin start -name CPD -path "$CPDIR/bin/cpd" -command "cpd"
  or
  cpstart
  
  

• VSX Gateway:

  [Expert@HostName:0]# vsenv <VSID>
  [Expert@HostName:<VSID>]# cpwd_admin start -name CPD -ctx <VSID> -path "$CPDIR/bin/cpd" -command "cpd" -env inherit
  or
  [Expert@HostName:0]# cpstart

fwd

• Logging
• Spawning child processes (e.g., vpnd)

• The "cpwd_admin list" command shows the process as "FWD".
• The "top" and "ps" commands might also show "fw" process and/or "fw_full" process, which are just wrappers for the "fwd" process.

• Management Server / Security Gateway:

  cpwd_admin stop -name FWD -path "$FWDIR/bin/fw" -command "fw kill fwd"
  or
  cpstop
  
  

• VSX Gateway:

  [Expert@HostName:0]# vsenv <VSID>
  [Expert@HostName:<VSID>]# cpwd_admin stop -name FWD -ctx <VSID> -path "$FWDIR/bin/fw" -command "fw kill fwd" -env inherit
  or
  [Expert@HostName:0]# cpstop

• Management Server / Security Gateway:

  cpwd_admin start -name FWD -path "$FWDIR/bin/fw" -command "fwd"
  or
  cpstart
  
  

• VSX Gateway:

  [Expert@HostName:0]# vsenv <VSID>
  [Expert@HostName:<VSID>]# cpwd_admin start -name FWD -ctx <VSID> -path "$FWDIR/bin/fwd" -command "fwd" -env inherit
  or
  [Expert@HostName:0]# cpstart

1. Start debug:
   fw debug fwd on TDERROR_ALL_ALL=5
   fw debug fwd on OPSEC_DEBUG_LEVEL=3
2. Replicate the issue
3. Stop debug:
   fw debug fwd off TDERROR_ALL_ALL=0
   fw debug fwd off OPSEC_DEBUG_LEVEL=0
4. Analyze:
   $FWDIR/log/fwd.elg*

cprid

cprid_wd

kissd

fwd

• Logging
• Spawning child processes (e.g., vpnd)

• The "cpwd_admin list" command shows the process as "FWD".
• The "top" and "ps" commands might also show "fw" process and/or "fw_full" process, which are just wrappers for the "fwd" process.

• Security Gateway:

  cpwd_admin stop -name FWD -path "$FWDIR/bin/fw" -command "fw kill fwd"
  or
  cpstop
  
  

• VSX Gateway:

  [Expert@HostName:0]# vsenv <VSID>
  [Expert@HostName:<VSID>]# cpwd_admin stop -name FWD -ctx <VSID> -path "$FWDIR/bin/fw" -command "fw kill fwd" -env inherit
  or
  [Expert@HostName:0]# cpstop

• Security Gateway:

  cpwd_admin start -name FWD -path "$FWDIR/bin/fw" -command "fwd"
  or
  cpstart
  
  

• VSX Gateway:

  [Expert@HostName:0]# vsenv <VSID>
  [Expert@HostName:<VSID>]# cpwd_admin start -name FWD -ctx <VSID> -path "$FWDIR/bin/fwd" -command "fwd" -env inherit
  or
  [Expert@HostName:0]# cpstart

1. Start debug:
   fw debug fwd on TDERROR_ALL_ALL=5
   fw debug fwd on OPSEC_DEBUG_LEVEL=3
2. Replicate the issue
3. Stop debug:
   fw debug fwd off TDERROR_ALL_ALL=0
   fw debug fwd off OPSEC_DEBUG_LEVEL=0
4. Analyze:
   $FWDIR/log/fwd.elg*

vpnd

R81.10 and higher:

• The single vpnd daemon handles these VPN connections:
  • All connections from non-IKE Remote Access clients (SSL Network Extender, Capsule VPN).
  • Multi-Portal (SSL/TLS) traffic.

R81 and lower:

• The single vpnd daemon handles these VPN connections:
  • IKE (UDP/TCP)
  • NAT-T
  • Tunnel Test
  • Reliable Datagram Protocol (RDP)
  • Topology Update for SecureClient
  • SSL Network Extender (SNX)
  • SSL Network Extender (SNX) Portal
  • Remote Access Client configuration
  • Visitor Mode
  • L2TP

• $FWDIR/bin/vpn

• %FWDIR%\bin\vpn

R81.20 and higher:

• $FWDIR/log/vpnd.elg*
• $FWDIR/log/vpnd.ikev1trace*
• $FWDIR/log/vpnd.ikev2trace*

R81.10:

• $FWDIR/log/vpnd.elg*
• $FWDIR/log/legacy_ike.elg*
• $FWDIR/log/legacy_ikev2.xml*

R81 and R80.40:

• $FWDIR/log/vpnd.elg*
• $FWDIR/log/ike.elg*
• $FWDIR/log/ikev2.xmll*

R80.30 and lower:

• $FWDIR/log/vpnd.elg*
• $FWDIR/log/ike.elg*

R77.30 and lower on Windows OS:

• %FWDIR%\log\vpnd.elg
• %FWDIR%\log\ike.elg

iked

This process exists starting from the R81.10 version.

R81.20 and higher:

• The multiple iked daemons (iked0, iked1, and so on) handle these VPN connections:
  • All connections from IKE Remote Access clients (for example, Endpoint clients).
  • All IKE Site-to-Site connections from peer Security Gateways, and Large Scale VPN (LSV) connections.
  • All connections from SmartLSM ROBO gateways.
  • All connections from Security Gateways with a Dynamically Assigned IP Address (DAIP).

R81.10:

• The single iked daemon handles these VPN connections:
  • All connections from IKE Remote Access clients (for example, Endpoint clients).
  • All IKE Site-to-Site connections from peer Security Gateways, and Large Scale VPN (LSV) connections.
  • All connections from SmartLSM ROBO gateways.
  • All connections from Security Gateways with a Dynamically Assigned IP Address (DAIP).

R81.20 and higher:

• $FWDIR/log/iked*.elg*
• $FWDIR/log/iked*.ikev1trace*
• $FWDIR/log/iked*.ikev2trace*

R81.10:

• $FWDIR/log/ike.elg*
• $FWDIR/log/iked.elg*
• $FWDIR/log/ikev2.xml*

cccd

This process exists starting from the R81.10 version.

The single cccd daemon is responsible for the Client Communication Channel (CCC) protocol, while:

• IKE for the same clients runs in the IKE daemons iked.
• The TLS layer of the CCC protocol for the same clients runs in the VPN daemon vpnd.

cvpnd

dbwriter

cvpnproc

1. Stop Mobile Access:
   cvpnstop
2. Verify that cvpnproc process is not running:
   ps aux | grep cvpnproc
3. If the cvpnproc process is still running, then kill it:
   kill -KILL $(pidof cvpnproc)
4. Start cvpnproc process under debug to run in background (by running these 2 commands):
   export TDERROR_ALL_ALL=5
   $CVPNDIR/bin/cvpnproc $CVPNDIR/log/cvpnproc.elg $CVPNDIR/conf/cvpnproc.C &
5. Start Mobile Access:
   cvpnstart
6. Replicate the issue
7. Stop debug:
   unset TDERROR_ALL_ALL
8. Stop Mobile Access:
   cvpnstop
9. Kill cvpnproc process:
   kill -TERM $(pidof cvpnproc)
   kill -KILL $(pidof cvpnproc)
10. Start Mobile Access:
    cvpnstart
11. Analyze:
    $CVPNDIR/log/cvpnproc.elg*

MoveFileServer

• In R77.30 and higher:
  as "MFSERVER"
• In R77.20 and lower:
  as "MOVEFILESERVER"

MoveFileDemuxer

The "cpwd_admin list" command shows the process:

• In R77.30 and higher:
  as "MFDEMUXER"
• In R77.20 and lower:
  as "MOVEFILEDEMUXER"

Pinger

1. Verify that Pinger process is running:
   ps aux | grep Pinger
2. Enable debug for relevant users:
   PingerAdmin debug users <user1>,<user2>,<user3>
3. Set the debug level:
   PingerAdmin debug set TDERROR_ALL_Pinger=3
   or
   PingerAdmin debug set TDERROR_ALL_ALL=5
4. Set the debug type:
   PingerAdmin debug type All
5. Delete all files from $CVPNDIR/log/trace_log/ directory:
   Note: Do NOT delete the directory itself!
   cd $CVPNDIR/log/trace_log/
   rm -i *
6. Enable trace log:
   Warning: This might print passwords to local files!
   PingerAdmin debug trace on
7. Start debug:
   PingerAdmin debug on
8. Replicate the issue
9. Stop debug:
   PingerAdmin debug off
10. Disable trace log:
    PingerAdmin debug trace off
11. Reset the debug:
    PingerAdmin debug reset
12. Analyze:
    $CVPNDIR/log/Pinger.log*

CvpnUMD

httpd

fwpushd

1. Enable debug:
   fwpush debug on
2. Set the debug options:
   fwpush debug set all all
3. Check the debug state:
   fwpush debug stat
4. Replicate the issue
5. Reset the debug options:
   fwpush debug reset
6. Disable debug:
   fwpush debug off
7. Check the debug state:
   fwpush debug stat
8. Analyze:
   $FWDIR/log/fwpushd.elg*

postgres

"su cp_postgres -c "$CPDIR/database/postgresql/bin/pg_ctl -D $RTDIR/events_db/data start"

Also refer to sk93970

pepd

Policy Enforcement Point daemon:

• Receiving identities via identity sharing
• Redirecting users to Captive Portal

pdpd

Policy Decision Point daemon:

• Acquiring identities from identity sources
• Sharing identities with another gateways

fwdlp

• $FWDIR/log/fwdlp.elg
• $DLPDIR/log/dlpe.log (refer to sk60387)
• $DLPDIR/log/dlpe_msg.log (refer to sk73660)
• $DLPDIR/log/dlpe_files_error.log

Refer to sk73660, sk60388:

1. Start debug:
   for PROC in $(pidof fwdlp) ; do fw debug $PROC on TDERROR_ALL_ALL=5 ; done
2. Replicate the issue
3. Stop debug:
   for PROC in $(pidof fwdlp) ; do fw debug $PROC off TDERROR_ALL_ALL=0 ; done
4. Analyze:
   $FWDIR/log/fwdlp.elg*

cp_file_convert

Refer to sk73660:

1. Start debug:
   for PROC in $(pgrep cp_file_convert) ; do fw debug $PROC on TDERROR_ALL_ALL=5 ; done
2. Replicate the issue
3. Stop debug:
   fw debug cp_file_convert off TDERROR_ALL_ALL=0
4. Analyze:
   • /var/log/jail/$FWDIR/log/cp_file_convertd.elg*
   • $FWDIR/log/cp_file_convertd.elg*

dlp_fingerprint

cserver

Refer to sk73660:

1. Start debug:
   fw debug cserver on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug cserver off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/cserver.elg*

dlpu

Refer to sk73660:

1. Start debug:
   for PROC in $(pidof dlpu) ; do fw debug $PROC on TDERROR_ALL_ALL=5 ; done
2. Replicate the issue
3. Stop debug:
   for PROC in $(pidof dlpu) ; do fw debug $PROC off TDERROR_ALL_ALL=0 ; done
4. Analyze:
   $FWDIR/log/dlpu.elg*

fwucd

Refer to sk73660, sk60388:

1. Start debug:
   fw debug fwucd on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug fwucd off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/fwucd.elg*

usrchkd

• $FWDIR/conf/usrchkd.conf
• $FWDIR/orig/UCPortal/fwdir_conf/usrchkd.conf
• $FWDIR/conf/fwauthd.conf

• This daemon is not monitored by Check Point WatchDog ("cpwd_admin list")
• This daemon is spawned by the FWD daemon

Note: It might also be required to collect the relevant kernel debug.

1. Start debug:
   usrchk debug set all all
2. Verify:
   usrchk debug stat
3. Replicate the issue.
4. Stop debug:
   usrchk debug off
5. Analyze:
   $FWDIR/log/usrchkd.elg*

usrchk

ted

dlpu

Refer to sk73660:

1. Start debug:
   fw debug dlpu on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug dlpu off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/dlpu.elg*

usrchkd

• $FWDIR/conf/usrchkd.conf
• $FWDIR/orig/UCPortal/fwdir_conf/usrchkd.conf
• $FWDIR/conf/fwauthd.conf

• This daemon is not monitored by Check Point WatchDog ("cpwd_admin list")
• This daemon is spawned by the FWD daemon

Note: It might also be required to collect the relevant kernel debug.

1. Start debug:
   usrchk debug set all all
2. Verify:
   usrchk debug stat
3. Replicate the issue.
4. Stop debug:
   usrchk debug off
5. Analyze:
   $FWDIR/log/usrchkd.elg*

usrchk

scanengine_b

scanengine_k

scanengine_s

scrub

• $FWDIR/log/scrubd.elg
• /var/log/scrub/scrubd_messages
• $CPDIR/log/scrub_plg.log

1. Start Threat Extraction debug:
   scrub debug on
   scrub debug set all all
2. Verify Threat Extraction debug is enabled:
   scrub debug stat
3. Start debug of cp_file_convert daemon:
   for PROC in $(pgrep cp_file_convert) ; do fw debug $PROC on TDERROR_ALL_ALL=5 ; done
4. Replicate the issue
5. Stop debug of cp_file_convert daemon:
   for PROC in $(pgrep cp_file_convert) ; do fw debug $PROC off TDERROR_ALL_ALL=0 ; done
6. Stop Threat Extraction debug:
   scrub debug off
   scrub debug reset
7. Verify Threat Extraction debug is disabled:
   scrub debug stat
8. Analyze:
   $FWDIR/log/scrubd.elg*
   /var/log/jail/$FWDIR/log/scrub_cp_file_convertd.elg

scrubd

• $FWDIR/log/scrubd.elg
• /var/log/scrub/scrubd_messages
• $CPDIR/log/scrub_plg.log

1. Start Threat Extraction debug:
   scrub debug on
   scrub debug set all all
2. Verify Threat Extraction debug is enabled:
   scrub debug stat
3. Start debug of cp_file_convert daemon:
   for PROC in $(pgrep cp_file_convert) ; do fw debug $PROC on TDERROR_ALL_ALL=5 ; done
4. Replicate the issue
5. Stop debug of cp_file_convert daemon:
   for PROC in $(pgrep cp_file_convert) ; do fw debug $PROC off TDERROR_ALL_ALL=0 ; done
6. Stop Threat Extraction debug:
   scrub debug off
   scrub debug reset
7. Verify Threat Extraction debug is disabled:
   scrub debug stat
8. Analyze:
   $FWDIR/log/scrubd.elg*
   /var/log/jail/$FWDIR/log/scrub_cp_file_convertd.elg

scrub_cp_file_convertd

• /var/log/jail/$FWDIR/log/scrub_cp_file_convertd.elg
• $FWDIR/log/cp_file_convert_start.log

1. Start debug:
   for PROC in $(pgrep cp_file_convert) ; do fw debug $PROC on TDERROR_ALL_ALL=5 ; done
2. Replicate the issue
3. Stop debug:
   for PROC in $(pgrep cp_file_convert) ; do fw debug $PROC off TDERROR_ALL_ALL=0 ; done
4. Analyze:
   /var/log/jail/$FWDIR/log/scrub_cp_file_convertd.elg*

in.emaild.mta

• $FWDIR/log/emaild.mta.elg
• /var/log/scrub/in.emaild.mta_messages

Refer to sk139892 - MTA Engine Debugging

usrchkd

• $FWDIR/conf/usrchkd.conf
• $FWDIR/orig/UCPortal/fwdir_conf/usrchkd.conf
• $FWDIR/conf/fwauthd.conf

• This daemon is not monitored by Check Point WatchDog ("cpwd_admin list")
• This daemon is spawned by the FWD daemon

Note: It might also be required to collect the relevant kernel debug.

1. Start debug:
   usrchk debug set all all
2. Verify:
   usrchk debug stat
3. Replicate the issue.
4. Stop debug:
   usrchk debug off
5. Analyze:
   $FWDIR/log/usrchkd.elg*

usrchk

tp_conf_service

1. cpwd_admin stop -name TP_CONF_SERVICE
2. cpwd_admin start -name TP_CONF_SERVICE -path $FWDIR/bin/tp_conf_service -command "tp_conf_service --conf=tp_conf.json --log=info"

tpd

1. Start debug:
   fw debug tpd on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug tpd off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/tpd.elg*

in.geod

Refer to sk102329:

1. Start debug:
   fw debug in.geod on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug in.geod off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/geod.elg*

rad

• $FWDIR/conf/rad_scheme.C
• $FWDIR/conf/rad_settings.C
• $FWDIR/database/rad_services.C

Refer to sk92743:

1. Start debug:
   rad_admin rad debug on all
2. Replicate the issue.
3. Stop debug:
   rad_admin rad debug off ALL
4. Analyze:
   $FWDIR/log/rad.elg*

usrchkd

• $FWDIR/conf/usrchkd.conf
• $FWDIR/orig/UCPortal/fwdir_conf/usrchkd.conf
• $FWDIR/conf/fwauthd.conf

• This daemon is not monitored by Check Point WatchDog ("cpwd_admin list")
• This daemon is spawned by the FWD daemon

Note: It might also be required to collect the relevant kernel debug.

1. Start debug:
   usrchk debug set all all
2. Verify:
   usrchk debug stat
3. Replicate the issue.
4. Stop debug:
   usrchk debug off
5. Analyze:
   $FWDIR/log/usrchkd.elg*

usrchk

• $FWDIR/conf/rad_scheme.C
• $FWDIR/conf/rad_settings.C
• $FWDIR/database/rad_services.C

Refer to sk92743:

1. Start debug:
   rad_admin rad debug on all
2. Replicate the issue.
3. Stop debug:
   rad_admin rad debug off ALL
4. Analyze:
   $FWDIR/log/rad.elg*

in.acapd

Refer to sk108179:

1. Start debug:
   fw debug in.acapd on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug in.acapd off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/acapd.elg*

rad

• $FWDIR/conf/rad_scheme.C
• $FWDIR/conf/rad_settings.C
• $FWDIR/database/rad_services.C

Refer to sk92264:

1. Start debug:
   rad_admin rad debug on all
2. Replicate the issue.
3. Stop debug:
   rad_admin rad debug off ALL
4. Analyze:
   $FWDIR/log/rad.elg*

usrchkd

• $FWDIR/conf/usrchkd.conf
• $FWDIR/orig/UCPortal/fwdir_conf/usrchkd.conf
• $FWDIR/conf/fwauthd.conf

• This daemon is not monitored by Check Point WatchDog ("cpwd_admin list")
• This daemon is spawned by the FWD daemon

Note: It might also be required to collect the relevant kernel debug.

1. Start debug:
   usrchk debug set all all
2. Verify:
   usrchk debug stat
3. Replicate the issue.
4. Stop debug:
   usrchk debug off
5. Analyze:
   $FWDIR/log/usrchkd.elg*

usrchk

in.acapd

Refer to sk108179:

1. Start debug:
   fw debug in.acapd on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug in.acapd off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/acapd.elg*

in.emaild.mta

Refer to sk60387:

1. Start debug:
   fw debug in.emaild.mta on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug in.emaild.mta off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/emaild.mta.elg*

in.emaild.smtp

Refer to sk60387:

1. Start debug:
   fw debug in.emaild.smtp on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug in.emaild.smtp off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/emaild.smtp.elg*

in.emaild.pop3

1. Start debug:
   fw debug in.emaild.pop3 on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug in.emaild.pop3 off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/emaild.pop3.elg*

dlpu

Refer to sk73660:

1. Start debug:
   fw debug dlpu on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug dlpu off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/dlpu.elg*

rad

• $FWDIR/conf/rad_scheme.C
• $FWDIR/conf/rad_settings.C
• $FWDIR/database/rad_services.C

Refer to sk92264:

1. Start debug:
   rad_admin rad debug on all
2. Replicate the issue.
3. Stop debug:
   rad_admin rad debug off ALL
4. Analyze:
   $FWDIR/log/rad.elg*

usrchkd

• $FWDIR/conf/usrchkd.conf
• $FWDIR/orig/UCPortal/fwdir_conf/usrchkd.conf
• $FWDIR/conf/fwauthd.conf

• This daemon is not monitored by Check Point WatchDog ("cpwd_admin list")
• This daemon is spawned by the FWD daemon

Note: It might also be required to collect the relevant kernel debug.

1. Start debug:
   usrchk debug set all all
2. Verify:
   usrchk debug stat
3. Replicate the issue.
4. Stop debug:
   usrchk debug off
5. Analyze:
   $FWDIR/log/usrchkd.elg*

usrchk

in.emaild.smtp

Refer to sk60387:

1. Start debug:
   fw debug in.emaild.smtp on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug in.emaild.smtp off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/emaild.smtp.elg*

in.msd

Refer to sk92264:

1. Start debug:
   fw debug in.msd on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug in.msd off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/msd.elg*

ctasd

ctipd

rtmd

Refer to skI2821:

1. Start debug:
   rtm debug on TDERROR_ALL_ALL=5
   rtm debug on OPSEC_DEBUG_LEVEL=3
2. Replicate the issue
3. Stop debug:
   rtm debug off TDERROR_ALL_ALL=0
   rtm debug off OPSEC_DEBUG_LEVEL=0
4. Analyze:
   $FWDIR/log/rtmd.elg*

cpstat_monitor

• The "cpwd_admin list" command shows the process as "CPSM".
• By default, does not run in the context of Domain Management Servers.
• By default, in MGMT HA runs only on "Active" Security Management Server.

wstlsd

Refer to sk105559:

1. Start debug:
   for PROC in $(pidof wstlsd) ; do fw debug $PROC on TDERROR_ALL_ALL=6 ; done
2. Replicate the issue (it is very important to collect the relevant traffic using both TCPDump tool and the FW Monitor).
3. Stop debug:
   for PROC in $(pidof wstlsd) ; do fw debug $PROC off TDERROR_ALL_ALL=0 ; done
4. Analyze:
   $FWDIR/log/wstlsd.elg*

pkxld

wsdnsd

Refer to sk106443:

1. Start debug:
   fw debug wsdnsd on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug wsdnsd off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/wsdnsd.elg*

cphamcset

• Refer to ATRG: ClusterXL R6x and R7x.
• Log file exists only in R77.20 and higher

1. Stop clustering:
   cphastop
2. Start under debug:
   cphamcset -d
3. Stop Check Point services:
   cphastop
4. Start clustering:
   cphastart

cphaprob

cphaconf

• Refer to ATRG: ClusterXL R6x and R7x - Chapter "ClusterXL Monitoring and Troubleshooting" - 'cphaconf' command.
• Log file exists only in R77.20 and higher

cphastart

• Refer to ATRG: ClusterXL R6x and R7x - Chapter "ClusterXL Monitoring and Troubleshooting" - 'cphastart' and 'cphastop' commands.
• Log file exists only in R77.20 and higher

cphastop

cxld

sxl_statd

dsd

• The "cpwd_admin list" command shows the process as "SDAEMON".
• See the Performance Tuning Administration Guide for your version.

1. dynamic_split -o enable
2. reboot

CPUS_USGS

Special task in the Check Point WatchDog on a Scalable Platform Security Group in the VSX mode (Maestro and Chassis) in R81 and higher.

This task runs a Python script that collects the Resource Control data (CPU and Memory utilization) from each Virtual System and sends it to the "asg perf" tool.

cpm

From Security Management Server R80:

• Serves requests from SmartConsole
• Responsible for writing all information to the PostgreSQL and SOLR databases

cpstop

• $FWDIR/scripts/ngm_stop.sh
  (refer to $FWDIR/log/ngm_stop.elg)
• $MDS_TEMPLATE/scripts/ngm_stop.sh
  (refer to $MDS_TEMPLATE/log/ngm_stop.elg)

cpstart

• $FWDIR/scripts/ngm_start.sh
  (refer to $FWDIR/log/ngm_start.elg)
• $MDS_TEMPLATE/scripts/ngm_start.sh
  (refer to $MDS_TEMPLATE/log/ngm_start.elg)

fwm

cpwd_admin stop -name FWM -path "$FWDIR/bin/fwm" -command "fw kill fwm"

• $FWDIR/scripts/ngm_stop.sh
  (refer to $FWDIR/log/ngm_stop.elg)
• $MDS_TEMPLATE/scripts/ngm_stop.sh
  (refer to $MDS_TEMPLATE/log/ngm_stop.elg)

cpwd_admin start -name FWM -path "$FWDIR/bin/fwm" -command "fwm"

• $FWDIR/scripts/ngm_start.sh
  (refer to $FWDIR/log/ngm_start.elg)
• $MDS_TEMPLATE/scripts/ngm_start.sh
  (refer to $MDS_TEMPLATE/log/ngm_start.elg)

• Security Management Server - refer to sk86186:

  1. Start debug:
     fw debug fwm on TDERROR_ALL_ALL=5
     fw debug fwm on OPSEC_DEBUG_LEVEL=3
  2. Replicate the issue
  3. Stop debug:
     fw debug fwm off TDERROR_ALL_ALL=0
     fw debug fwm off OPSEC_DEBUG_LEVEL=0
  4. Analyze:
     $FWDIR/log/fwm.elg*

• Domain Management Server - refer to sk33207:

  1. Switch to the context of the relevant Domain Management Server:
     mdsenv <Domain_Name>
  2. Start debug:
     fw debug fwm on TDERROR_ALL_ALL=5
     fw debug fwm on OPSEC_DEBUG_LEVEL=3
  3. Replicate the issue
  4. Stop debug:
     fw debug fwm off TDERROR_ALL_ALL=0
     fw debug fwm off OPSEC_DEBUG_LEVEL=0
  5. Analyze:
     $FWDIR/log/fwm.elg*

• Multi-Domain Security Management Server - refer to sk33208:

  1. Start debug:
     fw debug mds on TDERROR_ALL_ALL=5
     fw debug mds on OPSEC_DEBUG_LEVEL=3
  2. Replicate the issue
  3. Stop debug:
     fw debug mds off TDERROR_ALL_ALL=0
     fw debug mds off OPSEC_DEBUG_LEVEL=0
  4. Analyze:
     $MDS_TEMPLATE/log/mds.elg*

uepm

uepm debug

Also refer to sk92619

httpd

rtmd

1. Start debug:
   rtm debug on TDERROR_ALL_ALL=5
   rtm debug on OPSEC_DEBUG_LEVEL=3
2. Replicate the issue
3. Stop debug:
   rtm debug off TDERROR_ALL_ALL=0
   rtm debug off OPSEC_DEBUG_LEVEL=0
4. Analyze:
   $FWDIR/log/rtmd.elg*

cpstat_monitor

status_proxy

SVRServer

log_consolidator

• $RTDIR/log_consolidator_engine/conf/lc_rt_default.conf
• %RTDIR%\log_consolidator_engine\conf\lc_rt_default.conf (R77.30 and lower)
• $RTDIR/log_consolidator_engine/conf/<Log_Server_IP_Address>/lc_rt_default.conf
• %RTDIR%\log_consolidator_engine\conf\<Log_Server_IP_Address>\lc_rt_default.conf (R77.30 and lower)

rmdstop

or

evstop

or

log_consolidator -C -m stop -s <IP_Address _of_Log_Server> [-g <Domain_Name>]
and then
log_consolidator -C -m exit -s <IP_Address _of_Log_Server> [-g <Domain_Name>]

dbsync

• In R80 and higher:
  $FWDIR/log/dbsync.elg
• R77.30 and lower:
  $RTDIR/log/dbsync.elg
  %RTDIR%\log\dbsync.elg

• In R80 and higher:
  Runs part of CPM
• In R77.30 and lower:
  rmdstop
  or
  evstop
  or
  cpwd_admin stop -name DBSYNC

• In R80 and higher:
  Runs part of CPM
• In R77.30 and lower:
  rmdstart
  or
  evstart
  or
  cpwd_admin start -name DBSYNC -path "$RTDIR/bin/dbsync" -command "dbsync"

postgres

"su cp_postgres -c "$CPDIR/database/postgresql/bin/pg_ctl -D $RTDIR/events_db/data start"

Also refer to sk93970

cpsead

cpsemd

dbsync

java_solr

Starting in R80 (SmartEvent NGSE was integrated).

Jetty Server.

Events are stored in the SOLR database.

• $RTDIR/log/solr.log
• $RTDIR/log/solrRun.log

• $RTDIR/rfl_server/solr/solr.xml (R80.10 and higher)
• $RTDIR/conf/jetty.xml (R80 and higher)
• $RTDIR/conf/solr.log4j.properties (R80 and higher)
• $RTDIR/conf/solrConnectionConfig.xml (R80 and higher)
• $RTDIR/log_indexes/solr.xml (R80 and higher)

Refer to sk105806.

1. SmartEventSetDebugLevel solr <Debug_Level>
2. $FWDIR/scripts/solr_debug.py {on | off}

LogCore

Starting in R80 (SmartEvent NGSE was integrated).

Manages the queries it gets from the consumer processes, forwards them to SOLR database and returns the results. Also in charge of resolving and database maintenance (clean up old indexes to have space for the new ones).

• $RTDIR/log/RFL.log
• $RTDIR/log/rflRun.log

• $RTDIR/conf/rfl.log4j.properties
• $RTDIR/conf/rfl.log4j.properties.forUpgrade
• $RTDIR/conf/rflConfig.xml

Refer to sk105806.

SmartView

SmartEvent Web Application that allows you to connect to SmartEvent NGSE server (at https://<IP_Address_of_SmartEvent_Server>/smartview/) and see the event views and analysis directly from a Web Browser, without installing SmartConsole. The Web page comes with predefined views that you can customize.

Refer to sk105684.

• $RTDIR/log/smartview.log
• $RTDIR/log/SmartViewRun.log
• $RTDIR/log/smartview-service.log

Refer to sk105806.

log_indexer

Starting in R80 (SmartEvent NGSE was integrated).

• $RTDIR/log_indexer/conf/log_indexer_settings.conf
• $RTDIR/log_indexer/log_indexer_custom_settings.conf

evstop

Important - On a Multi-Domain Server, the evstop command stops the log_indexer process for all levels (MDS and Domains)

• On a Security Management Server:
  evstart
• On a Multi-Domain Server - for MDS context only:
  evstart
• On a Multi-Domain Server - for MDS context and Domain contexts:
  mdsstart

postgres

"su cp_postgres -c "$CPDIR/database/postgresql/bin/pg_ctl -D $RTDIR/events_db/data start"

Also refer to sk93970

cplmd

Refer to sk86324:

1. Start debug:
   fw debug cplmd on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug cplmd off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/cplmd.elg*

cpwmd

cp_http_server

smartlog_server

1. Stop SmartLog:
   smartlogstop
2. Start SmartLog under debug:
   env TDERROR_ALL_ALL=5 $SMARTLOGDIR/smartlog_server 1>> /var/log/smartlog.debug 2>> /var/log/smartlog.debug
3. Replicate the issue
4. Stop debug - press CTRL+C.
5. Start SmartLog normally:
   smartlogstart

cpca

Check Point Internal Certificate Authority (ICA):

• SIC certificate pulling
• Certificate enrollment
• CRL fetch
• Admin WebUI

Note: By default, in MGMT HA, it runs only on "Active" Security Management Server. On the "Backup" Security Management Server, the "cpstat mg" command will show "SmartCenter CA is not running".

Refer to sk60338:

1. Start debug:
   fw debug cpca on TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   fw debug cpca off TDERROR_ALL_ALL=0
4. Analyze:
   $FWDIR/log/cpca.elg*

interpreter

• In R77 and higher:
  $FWDIR/log/grc_interpreter.elg
  %FWDIR%\log\grc_interpreter.elg
  
  
• In R76:
  /opt/CPPIgrc-R76/bin/grc_interpreter.elg
  
  
• In R75.40/R75.45/R75.46/R75.47:
  /opt/CPPIgrc-R75.40/bin/grc_interpreter.elg

• In R77 and higher:
  
  1. Stop Check Point service with "cpstop" command
  2. Either run "interpreter debug=1" command,
     or in configuration file "grc.conf", manually set the value of "debugMode" from "0" to "1"
  3. Start Check Point service with "cpstart" command
• In R75.4x, R76:
  
  1. Stop Check Point service with "cpstop" command
  2. In configuration file "grc.conf", manually set the value of "debugMode" from "0" to "1"
  3. Start Check Point service with "cpstart" command

sms

lea_session

1. Start debug:
   fw debug fwd on TDERROR_ALL_ALL=5
   fw debug fwd on OPSEC_DEBUG_LEVEL=3
2. Replicate the issue
3. Stop debug:
   fw debug fwd off TDERROR_ALL_ALL=0
   fw debug fwd off OPSEC_DEBUG_LEVEL=0
4. Analyze:
   $FWDIR/log/lea_session.<PID>.elg*

sfwd

Main process:

• Logging
• Policy installation
• VPN negotiation
• Identity Awareness enforcement
• UserCheck enforcement
• etc.

• The "cpwd_admin list" command shows the process as "SFWD".
• The "ps auxw" command shows the process as "fw sfwd".

cposd

rtdbd

dropbear

• This process does not exist starting from the R80.20.60 and R81.10 versions.
• This process does not exist on 900, 700, and 600 models.

cpda.exe

• Communication with Harmony Endpoint Server - HTTPS
• Heart Beat & Sync
• Endpoint Authentication
• Software Deployment
• Managing Client State
• EMON (Reporting) Data
• Files & Drivers Download
• Policy Download

IDAFServerHostService.exe

• Communication with Harmony Endpoint Security Blades and with Device Agent
• Policy Storage (persistent)
• Provider Info Store EMON (Reporting), Harmony Endpoint Client state status and SYNC
• Harmony Endpoint Security Logs Store (persistent) and Logs from each Harmony Endpoint Security Blade

EPWD.exe

Imguardsvc64.exe

Imdci.exe

FDE_srv.exe

TESvc.exe

• Check Point Endpoint Threat Emulation
• Check Point Harmony Agent Threat Emulation (32 bit)

vsmon.exe

Compliance.exe

epab_svc.exe

NEM_svc.exe

RemediationService.exe

EFRService.exe

cptrayUI.exe

cptrayLogic.exe

disknet.exe

• Check Point ESME Client
• Check Point Endpoint Security MEPP Service

ServiceRequest.exe

Unlock.exe

TracSrvWrapper.exe

TrGui.exe

TracCAPI.exe

VPN_ProxyServer.exe

mpdaemon

Refer to sk87920:

1. Start debug:
   mpclient debug on
   mpclient debug set TDERROR_ALL_ALL=5
2. Replicate the issue
3. Stop debug:
   mpclient debug set TDERROR_ALL_ALL=0
   mpclient debug off

CloudGuard Controller

• To stop temporarily:
  vsec stop
• To stop permanently:
  vsec off

• To start after ‘vsec stop’:
  vsec start
• To start after ‘vsec off':
  vsec on

Refer to sk115657

avi_del_tmp_files

ci_http_server

1. Stop:
   cpwd_admin stop -name CIHS
2. Start under debug (with "-v" flag):
   cpwd_admin start -name CIHS -path $FWDIR/bin/ci_http_server -command "ci_http_server -v -j -f $FWDIR/conf/cihs.conf"
3. Replicate the issue
4. Stop:
   cpwd_admin stop -name CIHS
5. Start normally:
   cpwd_admin start -name CIHS -path $FWDIR/bin/ci_http_server -command "ci_http_server -j -f $FWDIR/conf/cihs.conf"

cp_http_server

1. Stop:
   cpwd_admin stop -name CPHTTPD
2. Start under debug (with "-v" flag):
   cpwd_admin start -name CPHTTPD -path "$WEBDIR/bin/cp_http_server" -command "cp_http_server -v -f '$MPDIR/conf/cp_httpd_admin.conf'"
3. Replicate the issue
4. Stop:
   cpwd_admin stop -name CPHTTPD
5. Start normally:
   cpwd_admin start -name CPHTTPD -path "$WEBDIR/bin/cp_http_server" -command "cp_http_server -f '$MPDIR/conf/cp_httpd_admin.conf'"

cpviewd

• In R77.30 and higher:
  $CPDIR/bin/cpviewd
• In R77, R77.10, R77.20:
  $FWDIR/bin/cpviewd

• In R77.30 and higher:
  cpwd_admin start -name CPVIEWD -path "$CPDIR/bin/cpviewd" -command "cpviewd"
  
  
• In R77, R77,10, R77.20:
  cpwd_admin start -name CPVIEWD -path "$FWDIR/bin/cpviewd" -command "cpviewd"

cpview_services

cpview_historyd

• In R77.30 and higher:
  $CPDIR/bin/cpview_historyd
• In R77, R77.10, R77.20:
  $FWDIR/bin/cpview_historyd

cpsnmpd

On Security Gateway and Management Server:

• Listens on UDP port 260 and is capable of responding to SNMP queries for Check Point OIDs only (under OID .1.3.6.1.4.1.2620)
• Accepts only SNMPv1
• Supplied as a part of Check Point Suite ($CPDIR/bin/cpsnmpd)

lpd

• Start debug:
  fw debug lpd on TDERROR_ALL_ALL=5
• Stop debug:
  fw debug lpd off TDERROR_ALL_ALL=0
• Replicate the issue
• Analyze:
  $FWDIR/log/lpd.elg*

spike_detective

CPU Spike Detective - see sk166454

• Non-Scalable Platforms - R81 and higher, R80.40 Jumbo Take 69 (and higher)
• On Maestro and Scalable Chassis - R81.10 and higher

• CPView > CPU > Spikes
• /var/log/spike_detective/spike_detective.log
• /var/log/messages (in R81 and higher)
• /var/log/spike_detective/data_spike_general_<Date>_<Time>/*
• /var/log/spike_detective/data_spike_thread_<Thread_ID>_<Date>_<Time>
• /var/log/spike_detective/data_spike_cpu_<Core_Number>_<Date>_<Time>

1. $CPDIR/bin/cpprod_util CPPROD_SetValue fw1 SpikedetectiveOff 4 1 1
2. reboot

Note - In R81 and higher, this tool is enabled by default

1. $CPDIR/bin/cpprod_util CPPROD_SetValue fw1 SpikedetectiveOff 4 0 1
2. reboot