> Source: [sk31793](https://support.checkpoint.com/results/sk/sk31793) # sk31793 - How to use the 'cpmistat' command | Property | Value | |----------|-------| | Solution ID | sk31793 | | Date Created | 2006-05-28 | | Last Modified | 2025-01-15 | | Technical Level | General | | Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server | | Versions | R82, R81.20, R81.10 (EOS), R82, R81.20, R81 (EOS), R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82 | ## Solution **Table of Contents:** * Introduction * Usage * Example * Errors ### Introduction {#Introduction} The `cpmistat` command is used to show values of various Check Point parameters. The command output can be produced in different formats: SNMP or CPMI Schema. **Best Practice** - The `cpmistat` command is considered outdated and may not provide the complete data. Use other tools to get the required data: the `cpstat` command, SNMP ([sk90860](https://support.checkpoint.com/results/sk/sk90860)), or the [Management API](https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction) commands. ### Usage {#Usage} The `cpmistat` command is executed in the Expert mode on a Security Management Server / Domain Security Management Server. `[Expert@MGMT_HostName]# cpmistat [-d] [-o {snmp | oid | schema}] -r {fw | vpn | fg | ha | os | mg | wac | ls}] `** Where: |------------|-----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Flag | Status | Description | | `-d` | Optional | Runs the tool in the debug mode. Output will be printed on the screen. It is strongly recommended to redirect the whole output to a file: `[Expert@MGMT_HostName]# cpmistat [-d] .... 1>> /var/log/cpmistat_output.txt 2>> /var/log/cpmistat_output.txt` | | `-o` | Optional | Specifies the output mode. * `snmp` - Shows SNMP OIDs in the text format. This is the default. * `oid` - Shows SNMP OIDs in the numerical format. * `schema` - Shows the full CPMI schema in the JSON format. | | `-r` | Mandatory | Specifies the name of the product that is queried: * `fw` - FireWall * `vpn` - VPN * `fg` - QoS (FloodGate-1) * `ha` - ClusterXL * `os` - Operating System * `mg` - Management Server * `wac` - User Authority WebAccess * `ls` - Log Server | | `` | Mandatory | Specifies the name of the network object as defined in SmartConsole (R80 and higher) / SmartDashboard (R77.30 and lower). | ### Example {#Example} In the example below, the queried object is: * Product is *FireWall* * Object name is "*my_gateway*" * Object's IP address is *10.10.10.10* * Policy name is "*MyPolicy*" ``` [Expert@MGMT_HostName]# cpmistat -r fw my_gateway application_open_events: false application_state: 0 bytes: 0 state: "Installed" fwStatus.fwStatCode: 0 fwStatus.fwStatShortDescr: "OK" fwStatus.fwStatLongDescr: "OK" fwStatus.fwProdName: "FireWall-1" fwStatus.fwVerMajor: 5 fwStatus.fwVerMinor: 9 fwStatus.fwKernelBuild: 591602015 fwStatus.fwPolicyStat.fwPolicyName: "MyPolicy" fwStatus.fwPolicyStat.fwLogged: 4 fwStatus.fwPolicyStat.fwRejected: 0 fwStatus.fwPolicyStat.fwDropped: 0 fwStatus.fwPolicyStat.fwInstallTime: "Sat Apr 22 10:43:40 2006" fwStatus.fwPolicyStat.fwNumConn: 5 fwStatus.fwPolicyStat.fwPeakNumConn: 42 .............. .............. .............. fwStatus.fwInterfacesTable.fwInterfaceEntry.fwInterfaceSlaves: "" fwStatus.fwInterfacesTable.fwInterfaceEntry.fwInterfaceName: "eth0" fwStatus.fwInterfacesTable.fwInterfaceEntry.fwInterfaceIP: "10.10.10.10" fwStatus.fwInterfacesTable.fwInterfaceEntry.fwInterfaceNetmask: "255.255.255.128" fwStatus.fwInterfacesTable.fwInterfaceEntry.fwInterfaceFlags: 0 fwStatus.fwInterfacesTable.fwInterfaceEntry.fwInterfacePeerName: "" fwStatus.fwInterfacesTable.fwInterfaceEntry.fwInterfaceRemoteIP: "0.0.0.0" fwStatus.fwInterfacesTable.fwInterfaceEntry.fwInterfaceTopology: 4 fwStatus.fwInterfacesTable.fwInterfaceEntry.fwInterfaceProxyName: "" summary.accepted: 2381 summary.rejected: 0 summary.dropped: 0 summary.logged: 4 ``` ### Errors {#Errors} |----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Error | ``` [Expert@MGMT_HostName]# cpmistat -o snmp -r fw my_gateway Failed to get status for FireWall-1@my_gateway Reason: Bad Status Report ``` | | Explanation | The CPMI status mechanism is not able to handle status data, which is larger than 16 kilobytes. | | Workaround/ Solution | On a Security Management Server / Domain Security Management Server, in the `$FWDIR/state/` directory, delete the directories that belong to non-existing Security Gateways / Clusters (these directories are created for each Gateway / Cluster during policy installation). > For example: > **Gateway_2** and **Cluster_2** machines were disassembled, and their objects were deleted in SmartConsole / SmartDashboard. > However, the corresponding directories might still exist on the Security Management Server / Domain Security Management Server: > ``` > [Expert@MGMT_HostName]# ls -l $FWDIR/state/ > total 20 > drwx------ 4 admin config 4096 Dec 9 17:11 Gateway_1 > drwx------ 4 admin config 4096 Dec 9 17:11 Gateway_2 > drwx------ 4 admin config 4096 Dec 9 17:11 Cluster_1 > drwx------ 4 admin config 4096 Dec 9 17:11 Cluster_2 > -rw-rw-r-- 1 admin config 2596 Dec 9 11:36 InternalCA_site.p12 > drwx------ 3 admin config 4096 Dec 9 17:08 __tmp > -rw-rw-r-- 1 admin config 427 Dec 9 17:11 links.C > drwx------ 6 admin config 4096 Dec 9 17:10 local > [Expert@MGMT_HostName]# > ``` > In such case: > ``` > [Expert@MGMT_HostName]# cd $FWDIR/state/ > [Expert@MGMT_HostName]# rm -rf Gateway_2 > [Expert@MGMT_HostName]# rm -rf Cluster_2 > ``` | --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content