What process monitors terminates, and restarts critical Check Point processes as necessary?
Correct Answer: C
* CPWD (Check Point WatchDog) is the process that monitors, terminates (if necessary), and restarts critical Check Point processes (e.g., FWD, FWM, CPM) when they stop responding or crash. * CPM (Check Point Management process) is a process on the Management Server responsible for the web-based SmartConsole connections, policy installations, etc. * FWD (Firewall Daemon) handles logging and communication functions in the Security Gateway. * FWM (FireWall Management) is an older reference to the management process on the Management Server for older versions. Therefore, the best answer is CPWD. Check Point Troubleshooting References * sk97638: Check Point WatchDog (CPWD) process explanation and commands. * R81.20 Administration Guide - Section on CoreXL, Daemons, and CPWD usage. * sk105217: Best Practices - Explains system processes, how to monitor them, and how CPWD is utilized.
Question 22
Where will the usermode core files located?
Correct Answer: D
Usermode core files are generated when a user mode process crashes. They are located in the $CPDIR/var/log /dump/usermode directory on the Security Gateway or Security Management server. The core files can be used to analyze the cause of the crash and troubleshoot the issue. The core files are named according to the process name, date, and time of the crash. For example, cpd_2023_02_03_16_40_55.core is a core file for the cpd process that crashed on February 3, 2023 at 16:40:55
Question 23
What does CMI stand for in relation to the Access Control Policy?
Correct Answer: B
Question 24
You found out that $FWDIR/Iog/fw.log is constantly growing in size at a Security Gateway, what is the reason?
Correct Answer: A
Question 25
Your users are having trouble opening a Web page and you need to troubleshoot it. You open the Smart Console, and you get the following message when you navigate to the Logs and Monitor "SmartLog is not active or Failed to parse results from server". What is the first thing you can try to resolve it?
Correct Answer: C
The error message "SmartLog is not active or Failed to parse results from server" indicates that there is a problem with the SmartLog server process, which is responsible for indexing and querying the logs. One possible cause of this problem is a corrupted log file or a mismatched IP address in the logging configuration files. Another possible cause is a communication failure between the SmartLog server and the CPM process or the SmartConsole client. To resolve this issue, the first thing to try is to restart the SmartLog server process by running the command smartlog_server restart on the Security Management Server or the Log Server. This command will stop the SmartLog server, clean the buffer, and start it again. This may fix the corrupted log file or the communication issue. If the problem persists, other steps may be needed, such as checking the network connectivity, the firewall rules, the logging configuration files, the CPM process, or the SmartConsole client. References: * 1: "SmartLog is not active or unreachable" warning when trying to connect with SmartLog GUI to SmartLog Server * 2: "SmartLog is not active" errors * 3: Solved: Activate SmartLog in R80.10 * 4: Troubleshooting Check Point logging issues when Security Management Server / Log Server is not receiving logs from Security Gateway * Troubleshooting Expert R81.1 (CCTE) Course Outline) - Module 9: Logging and Status Troubleshooting.
