RE: [FW1] ASCII logexport

[Ejvind Kristian <kristian.ejvind@FW1-NOSPAMspp.se>]

> I hope this isn't too far OT.

I would say this is severely "on", at least compared to
other mails on this list.

> to 97MB usually). Soon afterwards another cron job kicks off to export
> that binary log to ASCII for archival purposes. Of late, for some
> reason, that job seems to be taking an inordinate amount of time to
> complete - as much as eighteen hours in some cases. 

  Lucky you, I would say. My fw-1 logs are usually 50-100 MB
and I also kick of a logexport job after the switch. I do
it both with and without '-n' do disable or enable name
resolution in the exported logs. The '-n' export takes 20-40
minutes, and that export is cpu-bound. Using '-r1024' increases
speed a little.
  The non-'-n' export takes 15-25 hours. The record so far is
a 124 MB file that took 38 hours.
  I have made my reseller report this to CP.
  In my opinion, name resolution is nothing but defect
in FW-1. The resolved logs takes forever to generate and
the logviewer is almost useless when resolving is enabled.
  I've even installed a local caching-only name server
on the fw, and that did help to some extent.

/Kristian

-----------------------------------------
Kristian Ejvind - Kristian.Ejvind@spp.se
System admin at SPP Investment Management 
----------------------------------------


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================