Highlighted
carlos.alcocer@1 Absent Member.
Absent Member.
516 views

Checkpoint Smart Connector constantly drops events

Hi, we have 3 CheckPoint Smart Connectors  running version 6.03 that are constantly dropping events.  The connectors are configured to grab events from Checkpoint R75 firewalls with dual destination to ESM 4.5.2 SP2 and LOGGER 5.3.1.   We have changed the following parameters:

  • Java memory to 1 Gb.
  • Batching: 300 / 1 seg
  • http.transport.threadcount=4
  • agents[0].checkpoint.parser.multithreading.enabled=true
  • agents[0].checkpoint.parser.threadcount=4
  • http.transport.multithreaded=true

What is strange is that we have other connectors that are processing far more events and are not caching/dropping events.

Regards

Carlos

Labels (3)
0 Likes
Reply
3 Replies
UbissIctAppSic1 Respected Contributor.
Respected Contributor.

Re: Checkpoint Smart Connector constantly drops events

Hi Carlos,

I'm facing the same issue on our customer environment. Did you finally resolve it? And please, how?

Regards,

Giordano.

0 Likes
Reply
carlos.alcocer@1 Absent Member.
Absent Member.

Re: Checkpoint Smart Connector constantly drops events

Hi Goirdano,

I have been several methods to try to not miss events:

-Aggregation

-Increased memory

-Increased threadcount: http.transport.threadcount = 4

-Increased multithreading: agents [0] = true checkpoint.parser.multithreading.enabled.

The problem was solved in some way. Since we make estimates and comparisons in generating events and changes if worked. But we believe the Dashboard showing status information corresponding to that connector also information from other destinations, that is, you must do the tuning for each destination (ESM / Logger or Express).

If you have any further questions let me know.

Carlos


0 Likes
Reply
UbissIctAppSic1 Respected Contributor.
Respected Contributor.

Re: Checkpoint Smart Connector constantly drops events

Hello,

- Increased memory to 1024 mb.

- agents[0].checkpoint.parser.multithreading.enabled=true

- agents[0].checkpoint.parser.threadcount=4

- http.transport.threadcount=4

- http.transport.multithreaded=true

- Increased batching to 300 per 1 s

- Aggregation enabled per 1 sec

but it works for 1 hour max and then starts caching and dropping events...              

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.