CCSM Advanced Firewall Troubleshooting Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Check the connectivity and performance between the Security Gateway and the management/log server, and verify that the log server is not overloaded.

  Why this is correct

  The 'log buffer full' message indicates that the gateway is generating logs faster than they can be transmitted to the management server or written to local disk. This often results from network issues, a busy log server, or a high volume of log-generating traffic. Verifying connectivity, latency, and log server load is the correct first step to identify why the buffer is filling and to prevent the drops.

• ✗

  Restart the Check Point services on the gateway using 'cpstop; cpstart' to clear the log buffer and reset the logging subsystem.

  Why it's wrong here

  Restarting services will temporarily clear the buffer, but it is disruptive and does not resolve the root cause. The buffer will fill again if the underlying issue, such as a slow or unreachable log server, persists. This action also causes downtime and should be avoided unless absolutely necessary. Troubleshooting the log transmission path is a more appropriate and less disruptive approach.

• ✗

  Disable logging for the affected traffic by modifying the Security Policy to remove the track option from the relevant rules.

  Why it's wrong here

  Removing the track option would stop logs for those rules, but it is a drastic measure that eliminates visibility and does not address the underlying cause of the buffer filling. It could also violate compliance requirements. The issue is likely a bottleneck in log transmission or processing, not the logging configuration itself, so disabling logging is not the appropriate fix.

• ✗

  Increase the log buffer size by modifying the kernel parameter 'fw_log_buf_size' in $FWDIR/boot/modules/fwkern.conf.

  Why it's wrong here

  The kernel parameter 'fw_log_buf_size' does exist, but modifying it is not the standard or recommended solution for a full log buffer. The log buffer filling up usually indicates that logs are being generated faster than they can be written to disk or sent to the management server. Adjusting the buffer size may provide temporary relief but does not address the root cause, such as excessive logging or a communication issue with the log server.