> Source: [sk171505](https://support.checkpoint.com/results/sk/sk171505) # sk171505 - CPM Doctor Release Updates | Property | Value | |----------|-------| | Solution ID | sk171505 | | Date Created | 2021-01-13 | | Last Modified | 2026-10-14 | | Technical Level | General | | Products | Security Management Server, Multi-Domain Security Management Server | | Versions | R82.10, R82, R81.20, R82.20 | | OS | Gaia | ## Solution **Introduction \| Manual Installation \| Availability \| List of Resolved Issues \| Syntax \| Daily Run** Introduction {#Introduction} ---------------------------- **CPM Doctor** is a diagnostic tool (`$FWDIR/scripts/run_cpmdoc.sh`) that analyzes the health of Check Point Management Servers. Check Point Support uses this tool. The tool generates output files in the `$MDS_FWDIR/log/cpm_doctor/` directory. The main output of the tool is an HTML report with detected issues and possible troubleshooting steps. CPM Doctor is installed automatically on all relevant Check Point devices if the administrator allows the Automatic updates download as described in [sk175504](https://support.checkpoint.com/results/sk/sk175504)(section 2-B). If Automatic Updates are disabled, you must first manually install the latest [AutoUpdater](https://support.checkpoint.com/results/sk/sk165653) Take and then install the CPM Doctor package manually using the steps below. Availability {#Availability} ---------------------------- > |----------|-----------------|--------------------------------------------------------------------------------------------------------------------------| > | Update # | Release Date | Download package | > | Take 43 | 14 October 2026 | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://support.checkpoint.com/results/download/145982) (TAR) | Manual Offline Installation {#Manual Installation} -------------------------------------------------- 1. Download the offline package to your computer. See the "Availability" section. 2. Copy the offline package from your computer to your Check Point device to some directory (for example, */var/log/*). 3. Connect to the command line on your Check Point device. 4. Log in to Expert mode. 5. Go to the directory with the offline package. 6. Install the offline package: `autoupdatercli install .tar` **Note** : The installation does not require **`cpstop; cpstart`** or a reboot. Once installed, no further action is required, the update is applied immediately. List of Resolved Issues and New Features per CPM Doctor Update {#List of Resolved Issues} ----------------------------------------------------------------------------------------- |----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID | Description | | **Take 43 (14 October 2026)** || | ODU-4931 | The CVE Exposure section may be missing from the Hardening Recommendation Report when the Management Server connects to the Internet through a proxy. | | **Take 42 (16 September 2026)** || | ODU-4882 | Improved the accuracy of CVE exposure data in the Hardening Recommendation Report. | | **Take 39 (09 September 2026)** || | ODU-4777 | Added various quality enhancements and expanded CPM Doctor test coverage. | | **Take 34 (30 June 2026)** || | ODU-4344 | Added CPM Doctor tests to validate the Management Server hardening recommendations based on the [Check Point Gateway and Management Hardening Administration Guide](https://sc1.checkpoint.com/documents/Check_Point_Gateway_and_Management_Hardening/Default.htm). | {#limitations-Table} Syntax {#Syntax} ---------------- 1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server. 2. Log in to Expert mode. 3. On a Multi-Domain Security Management Server, go to the context of the relevant Domain Management Server: `mdsenv ` 4. Go to the relevant directory: `cd $FWDIR/scripts` 5. Run the CPM Doctor script: `./run_cpmdoc.sh [<`*options*`>]` CLI Options: |-------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Option | Description | | `-h` `--help` | Shows built-in help | | `-d ` `--logging_level ` | Configures the logging level. One of these: `OFF`, `ERROR`, `WARN`, `INFO`, `DEBUG`, `TRACE` | | `-n "NAME"` `--name "NAME"` | Specifies the names of test to run. To run two or more tests, separate their names with the semi-colon. Syntax: "`Test1;Test2;...`" Example: `./run_cpmdoc.sh -n "Solr/Postgres correlation test;Validate revisions is revision core"` | | `-nl` `--no_logs` | Specifies not to collect log files into the TGZ files. | | `-p "PATH"` `--path "PATH"` | Specifies the path to the output directory, in which to generate the HTML report and the TGZ files. **Important** - Such folder must already exist. Example: `./run_cpmdoc -p "/var/log/CPM_DOC"` | | `-rst` `--run_staging_tests` | Specifies to run all CPM Doctor tests, including the STAGING mode tests. Tests that are in the STAGING mode are tests that considered as unreliable - they might contain false positive. Nevertheless, such tests can provide important information about the server. | | `-s` `--skip_heavy_tests` | Runs the Hardening tests in CPM Doctor. Specifies to run CPM Doctor in the light mode (skip heavy tests). | | `-sc` `--sanity_check` | Runs the Sanity Check - making sure the CPM Doctor script is OK. | | `-sev ` `--min_sev ` | Configures the minimum severity level of tests to run (will run all tests with the specified severity and higher). One of these: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW` | | `-tpt ` `--timeout_per_test ` | Specifies the timeout in minutes for running each test. If a test does not complete within the specified timeout, the script starts the next test. | | `-upg` `--run_pre_upgrade_tests` | Specifies to run tests that are mandatory to pass before an upgrade | Daily Run {#Daily Run} ---------------------- The CPM Doctor daily run is available starting from: * R81 and higher (PMTR-51750) * R80.40 JHF Take 53 (PRJ-10999) * R80.30 JHF Take 210 (PRJ-10998) * R80.20 JHF Take 160 (PRJ-10997) * R80.10 JHF Take 278 (PRJ-10996) The default **daily** run time is **23h:30m**. The report files are saved in this directory: `$MDS_FWDIR/log/cpm_doctor` You can change the default daily run time in one of these ways: * Permanently - survives a reboot. * Temporarily - does not survive a reboot (after a reboot, the daily run time returns to the configured permanent value - default or user-defined). To change the **daily** run time: 1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server. 2. Log in to the Expert mode. 3. On a Multi-Domain Security Management Server, go to the context of the relevant Domain Management Server: `mdsenv ` 4. Back up the current script: `cp -v $CPDIR/tmp/.CPprofile.sh{,_BKP}` 5. Configure the desired daily run time: * **To change the daily time permanently, run:** `echo "CPM_DOCTOR_TIME= ; export CPM_DOCTOR_TIME" >> $CPDIR/tmp/.CPprofile.sh` Example for 21h:15m: `echo "CPM_DOCTOR_TIME=21-15 ; export CPM_DOCTOR_TIME" >> $CPDIR/tmp/.CPprofile.sh` * **To change the daily time temporarily, run:** * All supported versions: `$MDS_FWDIR/scripts/reload_env_vars.sh -e "CPM_DOCTOR_TIME="` Example for 21h:15m: `$MDS_FWDIR/scripts/reload_env_vars.sh -e "CPM_DOCTOR_TIME=21-15"` * Only R80.10 JHF Take 278 (and higher): `$MDS_FWDIR/scripts/reload_env_vars.sh export="CPM_DOCTOR_TIME:"` Example for 21h:15m: `$MDS_FWDIR/scripts/reload_env_vars.sh export="CPM_DOCTOR_TIME:21-15"` * **To disable the daily run permanently, run:** `echo "CPM_DOCTOR_TIME=OFF ; export CPM_DOCTOR_TIME" >> $CPDIR/tmp/.CPprofile.sh` * **To disable the daily run temporarily, run:** * All supported versions: `$MDS_FWDIR/scripts/reload_env_vars.sh -e "CPM_DOCTOR_TIME=OFF"` * Only R80.10 JHF Take 278 (and higher): `$MDS_FWDIR/scripts/reload_env_vars.sh export="CPM_DOCTOR_TIME:OFF"` 6. If you made the permanent change, then you must restart the Check Point services: * On a Security Management Server: `cpstop` `cpstart` * On a Multi-Domain Security Management Server: `mdsstop_customer ` `mdsstart_customer ` --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content