Packet drop counters increasing-checkpoint-all

Packet drop counters increasing-checkpoint-all
0

Packet drop counters increasing-checkpoint-all

Vendor: checkpoint

OS: all

Description:
indeni will track packet drop counters and alert if any important counters are incrementing.

Remediation Steps:
Contact your technical support provider.

How does this work?
indeni uses the built-in Check Point “asg_drop_monitor” command to retreive the number of drops.

Why is this important?
A large increase in dropped packets could mean that a new rule is blocking legitimate traffic, or that some traffic need a firewall rule to be allowed out.

Without Indeni how would you find this?
An administrator could login and manually run the command.

chkp-asg-drop-monitor

name: chkp-asg-drop-monitor
description: Retrieve drop data
type: monitoring
monitoring_interval: 1 minute
requires:
    vendor: checkpoint
    asg: true
comments:
    packet-drop-counter:
        why: |
            A large increase in dropped packets could mean that a new rule is blocking legitimate traffic, or that some traffic need a firewall rule to be allowed out.
        how: |
            indeni uses the built-in Check Point "asg_drop_monitor" command to retreive the number of drops.
        without-indeni: |
            An administrator could login and manually run the command.
        can-with-snmp: false
        can-with-syslog: false
        vendor-provided-management: Listing the drops is only available from the command
            line interface.
steps:
-   run:
        type: SSH
        command: cat `which asg_drop_monitor` | sed 's/watch -d -t/bash -c/' | bash
    parse:
        type: AWK
        file: asg-drop-monitor.parser.1.awk

cross_vendor_packet_drops

// Deprecation warning : Scala template-based rules are deprecated. Please use YAML format rules instead.

package com.indeni.server.rules.library.templatebased.crossvendor

import com.indeni.server.rules.RuleContext
import com.indeni.server.rules.library.templates.NumericThresholdOnDoubleMetricWithItemsTemplateRule
/**
  *
  */
case class cross_vendor_packet_drops() extends NumericThresholdOnDoubleMetricWithItemsTemplateRule(
  ruleName = "cross_vendor_packet_drops",
  ruleFriendlyName = "All Devices: Packet drop counters increasing",
  ruleDescription = "indeni will track packet drop counters and alert if any important counters are incrementing.",
  metricName = "packet-drop-counter",
  applicableMetricTag = "name",
  threshold = 100.0,
  alertDescription = "Some devices track the number of packets being dropped for various reasons. The current packet drop counters which are indicating dropped packets are listed below.",
  alertItemDescriptionFormat = "The drop counter is increasing at a rate of %.0f per second.",
  baseRemediationText = "Contact your technical support provider.",
  alertItemsHeader = "Affected Counters",
  itemsToIgnore = Set("flow_tcp_non_syn_drop".r, "flow_fwd_l3_bcast_drop".r, "flow_host_service_deny".r, "flow_ipv6_disabled".r, "flow_rcv_dot1q_tag_err".r, "flow_parse_l4_tcpsynfin".r, "flow_parse_l4_tcpfin".r, "flow_fwd_l3_mcast_drop".r, "^$".r))(
)