Packet drop counters increasing-checkpoint-all
indeni will track packet drop counters and alert if any important counters are incrementing.
Contact your technical support provider.
How does this work?
indeni uses the built-in Check Point “asg_drop_monitor” command to retreive the number of drops.
Why is this important?
A large increase in dropped packets could mean that a new rule is blocking legitimate traffic, or that some traffic need a firewall rule to be allowed out.
Without Indeni how would you find this?
An administrator could login and manually run the command.
name: chkp-asg-drop-monitor description: Retrieve drop data type: monitoring monitoring_interval: 1 minute requires: vendor: checkpoint asg: true comments: packet-drop-counter: why: | A large increase in dropped packets could mean that a new rule is blocking legitimate traffic, or that some traffic need a firewall rule to be allowed out. how: | indeni uses the built-in Check Point "asg_drop_monitor" command to retreive the number of drops. without-indeni: | An administrator could login and manually run the command. can-with-snmp: false can-with-syslog: false vendor-provided-management: Listing the drops is only available from the command line interface. steps: - run: type: SSH command: cat `which asg_drop_monitor` | sed 's/watch -d -t/bash -c/' | bash parse: type: AWK file: asg-drop-monitor.parser.1.awk
// Deprecation warning : Scala template-based rules are deprecated. Please use YAML format rules instead. package com.indeni.server.rules.library.templatebased.crossvendor import com.indeni.server.rules.RuleContext import com.indeni.server.rules.library.templates.NumericThresholdOnDoubleMetricWithItemsTemplateRule /** * */ case class cross_vendor_packet_drops() extends NumericThresholdOnDoubleMetricWithItemsTemplateRule( ruleName = "cross_vendor_packet_drops", ruleFriendlyName = "All Devices: Packet drop counters increasing", ruleDescription = "indeni will track packet drop counters and alert if any important counters are incrementing.", metricName = "packet-drop-counter", applicableMetricTag = "name", threshold = 100.0, alertDescription = "Some devices track the number of packets being dropped for various reasons. The current packet drop counters which are indicating dropped packets are listed below.", alertItemDescriptionFormat = "The drop counter is increasing at a rate of %.0f per second.", baseRemediationText = "Contact your technical support provider.", alertItemsHeader = "Affected Counters", itemsToIgnore = Set("flow_tcp_non_syn_drop".r, "flow_fwd_l3_bcast_drop".r, "flow_host_service_deny".r, "flow_ipv6_disabled".r, "flow_rcv_dot1q_tag_err".r, "flow_parse_l4_tcpsynfin".r, "flow_parse_l4_tcpfin".r, "flow_fwd_l3_mcast_drop".r, "^$".r))( )