Checkpoint caching

[sumsama1]

Hi, I have one checkpoint Firewall which caches most of the time. I have made the batching to 300:1 and increased the java heap to 1 Gb but still same. what else can I do to decrease the caching on connector

[AlexMuratov1]

What is EPS?

[sumsama1]

sent to  manager EPS is 1992.5

[sumsama1]

Total sent to manager EPS is 7833.1 and for checkpoint it is 2019.6

[vitz1]

what about Multithreading? Did you already enabel it?

[sumsama1]

I am using a Check Point OPSEC NG connector for this and are you talking about CPU or ESM transport multithreading ? and should there be a agent.default.properties file because its not there?

[pganguly1]

Hi Samal ,

Please add below parameter in agent.propertiy

http.transport.threadcount=16

http.transport.multithreaded=true

eventcache.scanforsize=false

http.transport.queuesize=600

agents[0].checkpoint.parser.multithreading.enabled=true

[AlexMuratov1]

What is ESM Manager version? It may be not able to ingest such high EPS. Though Check Point feed is well compressed usually (btw, check that you enabled field based aggregation) and should not be a problem.

[sumsama1]

ESM 6.8. What do you suggest the field based aggregation value to be ?

[sumsama1]

I added all of these values but still its caching..

[AlexMuratov1]

For Check Point I would suggest the following field based aggregation settings:

Time Interval: 15s

Event Threshold: 1000

Field Names: name, message, transportProtocol, destinationAddress, destinationPort, sourceAddress, deviceAddress

Fields to Sum: bytesIn, bytesOut

Preserve Common Fields: Yes

Important:

Enables aggregation (in secs): Disabled

This is a tricky part since the last setting is not global and it does not affect field based aggregation.

[AlexMuratov1]

What is RAM allocation for the ESM Manager? Allocate at least 32Gb.