Start with looking at /var/log/messages, looking at the NIC stats with ifconfig and ethtool, and fw ctl pstat.
On Thu, Jan 12, 2012 at 4:11 PM, a bv <vbavbal...@gmail.com> wrote: > Thanks this is a firewall SPLAT running on an open server . > > How can i find out the reasons ? > > > Regards > > 2012/1/12 Independent IT Consultant <itsec.itcons...@gmail.com>: > > modzap doesn't work on SPLAT. > > > > Is this a VSX system? TSID refers to the FWD daemon. > > > > Determine why your log buffer is filling before changing anything. > > Possible reasons may include high CPU, congestion on the wire, excessive > > errors on the wire, and so on. Could also be load on the management > > server. Look at these FIRST, and eliminate any issues you find. > > > > If there are no other apparent reasons why the log buffer is filling > (which > > there almost always is), then you can check the buffer size with "fw ctl > > get int fw_log_bufsize" If it's at the default (163840), try doubling it > > with "fw ctl set int fw_log_bufsize 327680". NOTE: this change will not > > survive a reboot. For that, you need to modify > > $FWDIR/boot/modules/fwkern.conf > > > > > > > > On Thu, Jan 12, 2012 at 7:38 AM, a bv <vbavbal...@gmail.com> wrote: > > > >> Hi, > >> > >> How do you react to the below messages when you see on > >> /var/log/messages ? Do you really change the kernel parameter > >> fw_log_bufsize ? Its said to be it must change with the modzap utility > >> at the portal, does it work on Secureplatform? How do you set the > >> parameter? Do you have any problems after having that? Do you ever see > >> the same messages again? Which logs are lost you guess? (access logs, > >> audit logs etc?) > >> > >> Regards > >> > >> [fw_0];FW-1: Log buffer for tsid=0 vsid=0 is full > >> kernel: [fw_0];FW-1: lost 2 log/trap messages for tsid=0 v > >> sid=0 > >> > >> ================================================= > >> To set vacation, Out-Of-Office, or away messages, > >> send an email to lists...@amadeus.us.checkpoint.com > >> in the BODY of the email add: > >> set fw-1-mailinglist nomail > >> ================================================= > >> To unsubscribe from this mailing list, > >> please see the instructions at > >> http://www.checkpoint.com/services/mailing.html > >> ================================================= > >> If you have any questions on how to change your > >> subscription options, email > >> fw-1-ow...@ts.checkpoint.com > >> ================================================= > >> > > > > ================================================= > > To set vacation, Out-Of-Office, or away messages, > > send an email to lists...@amadeus.us.checkpoint.com > > in the BODY of the email add: > > set fw-1-mailinglist nomail > > ================================================= > > To unsubscribe from this mailing list, > > please see the instructions at > > http://www.checkpoint.com/services/mailing.html > > ================================================= > > If you have any questions on how to change your > > subscription options, email > > fw-1-ow...@ts.checkpoint.com > > ================================================= > > Scanned by Check Point Total Security Gateway. > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to lists...@amadeus.us.checkpoint.com > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > fw-1-ow...@ts.checkpoint.com > ================================================= > > Scanned by Check Point Total Security Gateway. > ================================================= To set vacation, Out-Of-Office, or away messages, send an email to lists...@amadeus.us.checkpoint.com in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email fw-1-ow...@ts.checkpoint.com =================================================
