4.4 Real-Time Monitoring & Threat Analysis Tools

Overview of Check Point Monitoring & Diagnostic Suite

Effective security management requires comprehensive visibility into gateway hardware health, traffic throughput, acceleration status, and system logs. Check Point R82 provides a multi-tiered monitoring suite accessible through both graphical (SmartConsole / SmartView Monitor) and command-line interfaces (CPView, cpinfo, lslog, and fw log).

Understanding which tool to select during operational troubleshooting or performance tuning is a core competency evaluated on the CCSE R82 examination.

---

SmartView Monitor (GUI Real-Time Monitoring)

SmartView Monitor is a graphical monitoring application launched directly from SmartConsole (Logs & Monitor > Open SmartView Monitor). It provides centralized, real-time status monitoring across all managed Security Gateways and Security Management Servers.

+-----------------------------------------------------------------------+
|                     SmartView Monitor Core Views                      |
+-----------------------------------------------------------------------+
| 1. System Counters  : CPU, Memory, Disk usage, Active Connections     |
| 2. Traffic Counters : Real-time throughput (Mbps), Packet rates/sec   |
| 3. Gateway Status   : Operational state (OK, Attention, Down, Offline)|
| 4. VPN Monitoring   : Permanent Tunnels, Active SAs, Tunnel Reset     |
+-----------------------------------------------------------------------+

Key Features & Exam Points

• Gateway Status Monitoring: Displays visual health indicators (OK, Attention, Down, Disconnected) based on periodic high-priority status queries sent via SIC.
• Performance Counters: Tracks dynamic metrics in real time, including CPU utilization percentage, physical memory consumption, disk space usage, and active concurrent connection counts (fwx_alloc).
• Traffic Counter Views: Graphs real-time network throughput (Mbps) and packet processing rates (packets/sec) per interface, protocol, or Top-N traffic flows.
• VPN Tunnel Monitoring: Provides granular monitoring of Site-to-Site and Remote Access IPsec VPN tunnels:
  • Displays status of Permanent Tunnels (Up/Down).
  • Monitors IKE (Phase 1) and IPsec (Phase 2) Security Associations (SAs).
  • Allows administrators to reset/re-key VPN tunnels directly from the GUI interface during troubleshooting.

---

Gaia CPView (cpview) Command-Line Utility

CPView (cpview) is an interactive, terminal-based performance monitoring tool available in Gaia Clish and Expert mode. It provides detailed kernel-level visibility into appliance hardware, multi-core CPU allocation, and acceleration statistics.

Access & Navigation

Launch CPView from the Gaia CLI:

# Launch interactive real-time CPView monitor
[expert@GW01:0]# cpview

# Launch CPView in historical analysis mode
[expert@GW01:0]# cpview -history

CPView Core Sections

• Overview: Displays overall CPU usage, memory allocation, active connections, and top network interfaces.
• CPU (CoreXL & Multi-Queue): Breaks down CPU utilization per core. Crucially distinguishes between:
  • SND Cores (Secure Network Distributor): CPU cores dedicated to processing interface interrupts, handling Multi-Queue, and executing SecureXL acceleration.
  • FW Worker Cores: CPU cores dedicated to executing full stateful inspection and Software Blade processing in the kernel.
• SecureXL Acceleration: Displays acceleration statistics, showing traffic distribution across:
  • Accelerated Path (F2F = 0): Packets handled entirely in fast-path ASIC/kernel acceleration.
  • Medium Path (PXL): Packets handled by kernel acceleration with partial Software Blade inspection (e.g., IPS/App Control).
  • Slow Path (F2F - FireWall-to-FireWall): Packets passed to user-space daemons for deep inspection.
• VPN Statistics: Displays active IPsec tunnels, encryption/decryption throughput, and ESP packet drops.
• Historical Mode (cpview -history): Allows engineers to navigate back in time to inspect performance counters captured during past outage windows or traffic spikes.

---

Diagnostic System Snapshot Tool (cpinfo)

cpinfo is Check Point's long-standing diagnostic data collection utility. It captures a complete system snapshot containing OS settings, process state, hotfix inventory, and management database configuration into a single formatted text file (.info).

Command Syntax & Common Flags

# Generate a complete system diagnostic snapshot for Check Point TAC
[expert@GW01:0]# cpinfo -g -o /var/log/cpinfo_GW01_$(date +%Y%m%d).info

Generating a cpinfo snapshot is mandatory when submitting support cases to Check Point Technical Assistance Center (TAC).

---

Log Indexing Service (lslog)

On Log Servers and Security Management Servers, log searching is powered by the Log Indexing Daemon (lslog), which manages the embedded Apache Solr search index.

Key lslog CLI Administration Commands

# Check log indexing status and Solr index backlog
[expert@LogServer:0]# lslog status

# Check log indexing storage space and index health
[expert@LogServer:0]# lslog storage_status

# Repair a corrupted log index directory
[expert@LogServer:0]# lslog repair

Monitoring lslog status is essential when troubleshooting SmartConsole log search latency or backlogs in log ingestion.

---

Command-Line Log Analysis (fw log)

Security engineers frequently need to inspect raw security log files directly on a Security Gateway or Log Server without launching SmartConsole. The fw log command utility parses binary log files (.log) stored in /var/opt/CPsuite-R82/fw1/log/.

Essential fw log Syntax Examples

# Tail incoming log entries in real-time (live log follow mode)
[expert@GW01:0]# fw log -f

# Read a specific historical log file
[expert@GW01:0]# fw log -l 2026-07-22_000000.log

# Read log file and filter by drop action
[expert@GW01:0]# fw log -l 2026-07-22_000000.log -c drop

# Filter logs by specific host IP address
[expert@GW01:0]# fw log -l 2026-07-22_000000.log -b "192.168.10.50"

# Export parsed log file to plain text file for external analysis
[expert@GW01:0]# fw log -l 2026-07-22_000000.log > /tmp/parsed_logs.txt