CPUG: The Check Point User Group

Resources for the Check Point Community, by the Check Point Community.


Tim Hall has done it yet again - That's right, the 3rd edition is here!
You can read his announcement post here.
It's a massive upgrade focusing on current versions, and well worth checking out. -E

 

Results 1 to 15 of 15

Thread: Huge Backup on R80?

  1. #1
    Join Date
    2011-10-20
    Posts
    163
    Rep Power
    9

    Default Huge Backup on R80?

    Hey, I ran a backup from migrate export and realize that it's huge!

    Almost 4GB, our rulebase has 67 firewall rules and almost all blades enabled, but I think is a small amount of resources to this backup be so huge, am I wrong?

  2. #2
    Join Date
    2007-06-04
    Posts
    3,314
    Rep Power
    17

    Default Re: Huge Backup on R80?

    Quick Question

    1.) Are you backing up Logs as well when do the migrate export
    2.) How many Database Revisions present in your System

    These can balloon your migrate export size out quite a bit

  3. #3
    Join Date
    2006-03-08
    Location
    Lausanne
    Posts
    1,030
    Rep Power
    15

    Default Re: Huge Backup on R80?

    R80 keeps all your revisions. Might be the source of your issue
    -------------

    Valeri Loukine
    CCMA, CCSM, CCSI
    http://checkpoint-master-architect.blogspot.com/

  4. #4
    Join Date
    2011-10-20
    Posts
    163
    Rep Power
    9

    Default Re: Huge Backup on R80?

    Quote Originally Posted by varera View Post
    R80 keeps all your revisions. Might be the source of your issue

    Oh man I just realize that we have almost 200 revisions here. lol

    I will purge them, It's really a best practice maintain this?

  5. #5
    Join Date
    2009-04-30
    Location
    Colorado, USA
    Posts
    2,252
    Rep Power
    14

    Default Re: Huge Backup on R80?

    Purging old sessions will help reduce the size of the backup.
    --
    Third Edition of my "Max Power 2020" Firewall Book
    Now Available at http://www.maxpowerfirewalls.com

  6. #6
    Join Date
    2011-10-20
    Posts
    163
    Rep Power
    9

    Default Re: Huge Backup on R80?

    Quote Originally Posted by mcnallym View Post
    Quick Question

    1.) Are you backing up Logs as well when do the migrate export
    2.) How many Database Revisions present in your System

    These can balloon your migrate export size out quite a bit
    I'm not backing up the logs, I believe that is the revision, almost 200!

    I will purge and test again!

  7. #7
    Join Date
    2006-03-08
    Location
    Lausanne
    Posts
    1,030
    Rep Power
    15

    Default Re: Huge Backup on R80?

    Quote Originally Posted by crosspopz View Post
    Oh man I just realize that we have almost 200 revisions here. lol

    I will purge them, It's really a best practice maintain this?
    Depends on what you want to do with them. If they are pre-R80, there is no point to keep them. Otherwise, consult with your security policies and procedures.
    -------------

    Valeri Loukine
    CCMA, CCSM, CCSI
    http://checkpoint-master-architect.blogspot.com/

  8. #8
    Join Date
    2011-10-20
    Posts
    163
    Rep Power
    9

    Default Re: Huge Backup on R80?

    Quote Originally Posted by ShadowPeak.com View Post
    Purging old sessions will help reduce the size of the backup.
    This is enabled by default, it's a good practice?

    There is an automatic maintenance for that?

  9. #9
    Join Date
    2011-10-20
    Posts
    163
    Rep Power
    9

    Default Re: Huge Backup on R80?

    Quote Originally Posted by varera View Post
    Depends on what you want to do with them. If they are pre-R80, there is no point to keep them. Otherwise, consult with your security policies and procedures.


    Yeah for sure, but this is by default here in R80. I will take a look at the settings and try to change this.

    THanks!!!

  10. #10
    Join Date
    2011-10-20
    Posts
    163
    Rep Power
    9

    Default Re: Huge Backup on R80?

    Just to let you know guys, I removed almost all of the revisions, from 200 to 20.

    The backup still have 3.3GB.

  11. #11
    Join Date
    2008-07-31
    Location
    Netherlands, Europe
    Posts
    1,146
    Rep Power
    13

    Default Re: Huge Backup on R80?

    There is a big difference in revisions for R77.30 and DB revisions for R80, in R77.30 the revison was a complete copy of the full fileset, while R80 only keeps the changes.
    I have seen exports and imports on R77.30 for larger environment with many policies with 200-500 rules in them but these did not even extend above the 2 GB. The ones I have seen with larger exports, all later were found to have more than 20 revisions on them. I would try to find if there is a way to delete old DB revisions that were imported and are now not deleted with the R80 mechanisms.
    This is the method for removing R77.30 DB revisions made by SmartWorkFlow, atleast the DB part, maybe you can use that on your R80 setup:

    1. Run the "dbver"command:

      [Expert@HostName]# dbver
    2. List all database revisions:

      dbver> print_all
    3. Delete the unneeded session:

      dbver> delete SESSION_NUMBER
    Regards, Maarten.
    Triple MDS on R77.30, MDS on R80.10, VSX, GAIA.

  12. #12
    Join Date
    2011-10-20
    Posts
    163
    Rep Power
    9

    Default Re: Huge Backup on R80?

    Quote Originally Posted by msjouw View Post
    There is a big difference in revisions for R77.30 and DB revisions for R80, in R77.30 the revison was a complete copy of the full fileset, while R80 only keeps the changes.
    I have seen exports and imports on R77.30 for larger environment with many policies with 200-500 rules in them but these did not even extend above the 2 GB. The ones I have seen with larger exports, all later were found to have more than 20 revisions on them. I would try to find if there is a way to delete old DB revisions that were imported and are now not deleted with the R80 mechanisms.
    This is the method for removing R77.30 DB revisions made by SmartWorkFlow, atleast the DB part, maybe you can use that on your R80 setup:

    1. Run the "dbver"command:

      [Expert@HostName]# dbver
    2. List all database revisions:

      dbver> print_all
    3. Delete the unneeded session:

      dbver> delete SESSION_NUMBER
    I did this already, nothing was shown.

    [Expert@xxxxx:0]# dbver
    Enter Server name (ENTER for 'localhost'):

    Please enter a command:

    export <version_numbers> <delete | keep>
    import <exported_version_file_name>
    restore <version_number> <entire|keep_users>
    create <version_name> <version_comment>
    delete <version_numbers>
    print_all
    help
    quit

    dbver> print_all

    dbver> print_all

    dbver>


    Even R80 keeping only the changes, I removed almost all of them, backup now should be less than 3GB.

  13. #13
    Join Date
    2006-03-08
    Location
    Lausanne
    Posts
    1,030
    Rep Power
    15

    Default Re: Huge Backup on R80?

    I have checked on my environment, and R80 export file is below 400MB. In your case, I would suggest the following:

    1. Check that you do not have $FWDIR/conf/db_versions folder full of revisions older that R80. I bet you do. If there is anything there, delete it.
    2. In R80 SmartConsole to to Revisions and make sure you have just a reasonable amount of those.

    Try exporting again.

    The problem is, if you had R77.X revisions, R80 will not remove but also will not see them under Revisions tab. Pre-R80 revisions are huge.

    Please let me know if this helps
    -------------

    Valeri Loukine
    CCMA, CCSM, CCSI
    http://checkpoint-master-architect.blogspot.com/

  14. #14
    Join Date
    2011-10-20
    Posts
    163
    Rep Power
    9

    Default Re: Huge Backup on R80?

    Quote Originally Posted by varera View Post
    I have checked on my environment, and R80 export file is below 400MB. In your case, I would suggest the following:

    1. Check that you do not have $FWDIR/conf/db_versions folder full of revisions older that R80. I bet you do. If there is anything there, delete it.
    2. In R80 SmartConsole to to Revisions and make sure you have just a reasonable amount of those.

    Try exporting again.

    The problem is, if you had R77.X revisions, R80 will not remove but also will not see them under Revisions tab. Pre-R80 revisions are huge.

    Please let me know if this helps
    Valeri, thanks for the reply, but no success.

    [Expert@xxxxxxx:0]# cd $FWDIR/conf/db_versions
    [Expert@xxxxxxx:0]# ls
    database
    [Expert@xxxxxxx:0]# cd database
    [Expert@xxxxxxx:0]# ls
    [Expert@xxxxxxx:0]#

  15. #15
    Join Date
    2011-08-02
    Location
    http://spikefishsolutions.com
    Posts
    1,657
    Rep Power
    10

    Default Re: Huge Backup on R80?

    I haven't looked at a R80 backup before, but this should give you a report on disk usage.

    tar tvf backup.tgz | sort -rk3

    largest on top. Keep in mind it could be lots of med size files also, but if its a few really large files this should show it.

    BTW.. check admin's home dir. Maybe there is some junk in there being sucked up into the backup?

Similar Threads

  1. Replies: 0
    Last Post: 2016-09-19, 23:41
  2. Normal Anti Spoofing issue which gave way to an huge impact
    By networkuser in forum SmartDashboard
    Replies: 1
    Last Post: 2013-08-04, 00:13
  3. SmartCenter scalability to huge number of network objects
    By ggts2008 in forum Security Management Server (Formerly SmartCenter Server ((Formerly Management Server))
    Replies: 10
    Last Post: 2009-03-24, 07:07
  4. there are huge drop packages in internal and external interrfaces
    By ligang_sh in forum Check Point SecurePlatform (SPLAT)
    Replies: 3
    Last Post: 2007-12-06, 17:16
  5. Windows MGMT Server generates huge log files
    By gil.lim in forum SmartView Tracker
    Replies: 4
    Last Post: 2007-02-21, 21:41

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •