Log indexing is a feature that enables faster and more efficient log searches in SmartLog and SmartEvent. To enable log indexing on the Security Management Server (SMS), you need to edit the SMS object in SmartConsole and go to the “Logs” tab.  There you can configure the log indexing settings, such as the index location, the index size, the index frequency, and the index retention 1 2 3 .  References :

1 : CCTE Courseware, Module 2: Advanced Logs and Monitoring, Slide 9

2 : Check Point R81 Logging and Monitoring Administration Guide, Chapter 2: Log Indexing, Page 17

3 : Check Point R81 Logging and Monitoring Administration Guide, Chapter 2: Log Indexing, Page 18

The Unified Policy is a feature that allows you to create a single policy layer that combines the functionality of Access Control, Threat Prevention, and HTTPS Inspection 1 2 .  To debug the Unified Policy, you need to use the command  fw ctl debug  with the module name  UP  and the flag  all  or specific flags for different aspects of the Unified Policy inspection 3 4 . The possible flags for the Unified Policy module are:

up_match : Shows the matching process of the Unified Policy rules.

up_inspect : Shows the inspection process of the Unified Policy rules.

up_action : Shows the action process of the Unified Policy rules.

up_log : Shows the logging process of the Unified Policy rules.

up_tls : Shows the TLS inspection process of the Unified Policy rules.

up_clob : Shows the CLOB (Content Limitation and Optimization Blade) inspection process of the Unified Policy rules.

up_rulebase : Shows the rulebase loading process of the Unified Policy rules.

up_connection : Shows the connection tracking process of the Unified Policy rules.

The flag  tls  is not a valid flag for the Unified Policy module, as it is used for the TLS Inspection module 5 . Therefore, the correct answer is A. tls.  The other options are valid flags for the Unified Policy module, as explained above 3 4 .  References :

1 : CCTE Courseware, Module 8: Advanced Access Control, Slide 7

2 : Check Point R81 Security Gateway Architecture and Packet Flow, Chapter 5: Unified Policy, Page 29

3 : CCTE Courseware, Module 8: Advanced Access Control, Slide 17

4 : Check Point R81 Security Gateway Architecture and Packet Flow, Chapter 5: Unified Policy, Page 32

5 : Check Point R81 Security Gateway Architecture and Packet Flow, Chapter 6: TLS Inspection, Page 36

When a process is frozen (hung or unresponsive), the typical method to resolve it is to kill the process . On Check Point, you can use cpwd_admin kill -name < ProcessName > or a standard Linux kill -9 < PID > command if necessary. You then allow CPWD (the Check Point watchdog) to restart it, or manually restart it if needed.

Other options:

A. Power off the machine : This is too drastic and not recommended just for a single frozen process.

B. Restart the process : While this sounds viable, you typically must kill the frozen process first, then let WatchDog or an admin restart it.

C. Reboot the machine : Similar to powering off—too disruptive for just one stuck process.

Hence, the most direct and standard approach:

“Kill the process.”

Check Point Troubleshooting References

sk97638 – Explanation of CPWD (Check Point WatchDog) and how to manage processes.

sk43807 – How to gracefully stop or kill a Check Point process.

Check Point CLI Reference Guide – Details on using cpwd_admin commands to kill or restart processes.

Usermode core files are generated when a user mode process crashes. They are located in the $CPDIR/var/log/dump/usermode directory on the Security Gateway or Security Management server. The core files can be used to analyze the cause of the crash and troubleshoot the issue. The core files are named according to the process name, date, and time of the crash. For example, cpd_2023_02_03_16_40_55.core is a core file for the cpd process that crashed on February 3, 2023 at 16:40:55

The correct directory where an administrator can find vpn debug log files generated during Site-to-Site VPN troubleshooting is $FWDIR/log/. This directory contains the following files related to vpn debug:

vpnd.elg : This file contains the high-level VPN debug information, such as the VPN tunnel establishment, deletion, and negotiation messages. It can be enabled by using the vpn debug on command on the Security Gateway CLI.

legacy_ike.elg : This file contains the low-level IKE debug information for IKEv1, such as the IKE packets, encryption, decryption, and authentication. It can be enabled by using the vpn debug ikeon command on the Security Gateway CLI.

legacy_ikev2.xml : This file contains the low-level IKE debug information for IKEv2, such as the IKE packets, encryption, decryption, and authentication. It can be enabled by using the vpn debug ikev2on command on the Security Gateway CLI.

These files can be viewed by using the vpn debug view command on the Security Gateway CLI, or by using the IKEView tool on the Security Management Server GUI.

The STAT column in the output of the cpwd_admin list command shows the status of the monitored process. The possible values are E for established, meaning that the process is running, or T for terminated, meaning that the process is not running. The STAT column is useful for quickly checking if any critical process has crashed or failed to start. If the value is T, the process should be restarted and the reason for the termination should be investigated. The STAT column does not show the Watch Dog name, the number of times the process was started, or the monitoring method of the Watch Dog.