> Source: [sk34476](https://support.checkpoint.com/results/sk/sk34476) # sk34476 - ClusterXL Sync Statistics - output of 'fw ctl pstat' command | Property | Value | |----------|-------| | Solution ID | sk34476 | | Date Created | 2008-02-24 | | Last Modified | 2026-10-12 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20 | ## Solution **Note:** This sk is relevant for versions until R80.10. For R80.20 and higher, refer to [sk34475](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk34475). Refer to *ClusterXL Administration Guide* ([R55](http://supportcontent.checkpoint.com/documentation_download?id=5677), [R60](http://supportcontent.checkpoint.com/documentation_download?id=5509), [R61](http://supportcontent.checkpoint.com/documentation_download?id=6355), [R62](http://supportcontent.checkpoint.com/documentation_download?id=6824), [R65](http://supportcontent.checkpoint.com/documentation_download?id=7240), [R70](http://supportcontent.checkpoint.com/documentation_download?id=8714), [R70.1](http://supportcontent.checkpoint.com/documentation_download?id=10068), [R71](http://supportcontent.checkpoint.com/documentation_download?id=10641), [R75](http://supportcontent.checkpoint.com/documentation_download?id=11659), [R75.20](http://supportcontent.checkpoint.com/documentation_download?id=12265), [R75.40](http://supportcontent.checkpoint.com/documentation_download?id=13090), [R75.40VS](http://supportcontent.checkpoint.com/documentation_download?id=16221), [R76](http://supportcontent.checkpoint.com/documentation_download?id=22910), [R77](http://supportcontent.checkpoint.com/documentation_download?id=24800)) - Chapter 'Monitoring and Troubleshooting Gateway Clusters' - Monitoring Synchronization (fw ctl pstat). Example of the '**Sync** ' section in the output of `'`**fw ctl pstat**`'` command: ``` Sync: Version: new Status: Able to Send/Receive sync packets Sync packets sent: total : 466729198, retransmitted :241305, retrans reqs : 6089, acks : 809 Sync packets received: total : 77283541, were queued : 6715, dropped by net : 6079 retrans reqs : 37462, received 221 acks retrans reqs for illegal seq : 2 dropped updates as a result of sync overload: 3 Delta Sync memory usage: currently using XX KB mem Callback statistics: handled 165 cb, average delay : 3, max delay : 34 Number of Pending packets currently held: 1 Packets released due to timeout: 18 ``` |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Output section | Explanation | | ``` Sync: off ``` | Delta Sync is disabled: * Full Sync failed (refer to the output of '`cphaprob -ia list`' command - check the state of '`Synchronization`' pnote) * Delta Sync was disabled by cluster administrator (the box '`Use State Synchronization`' was not checked in cluster object, or ran the '`fw ctl setsync off`' command) * Sync interface was removed from cluster configuration (refer to the output of '`cphaprob -a if`' command) | | ``` Sync: Live connections update: on ``` | 'Active Mode' tab is opened in SmartView Tracker. Refer to [sk30908](http://supportcontent.checkpoint.com/solutions?id=sk30908). | | ``` Sync: Version: old ``` | Check Point FW-1 v4.1 and lower. | | ``` Sync: Version: new ``` | Check Point FW-1 NG and higher. | | ``` Sync: Version: new Status: Able to Send/Receive sync packets ``` | Delta Sync works correctly. | | ``` Sync: Version: new Status: Able to send sync packets Unable to receive sync packets ``` or ``` Sync: Version: new Status: Unable to send sync packets Unable to receive sync packets ``` | The problem is described in the output itself (requires cluster debugging). | | ``` Sync: Version: new Status: Able to send sync packets Saving incoming sync packets ``` or ``` Sync: Version: new Status: Unable to send sync packets Saving incoming sync packets ``` | The problem is described in the output itself (requires cluster debugging). | | ``` Sync: Version: new Status: Able to send sync packets Able to receive sync packets ``` or ``` Sync: Version: new Status: Unable to send sync packets Able to receive sync packets ``` | The problem is described in the output itself (requires cluster debugging). | | ``` Sync packets sent: �total : 466729198, retransmitted :241305, retrans reqs : 6089, acks : 809 ``` | * TOTAL number of sync packets is non-zero and increasing. * RETRANS REQS may increase under load. | | ``` Sync packets received: �total : 77283541, were queued : 6715, dropped by net : 6079 �retrans reqs : 37462, received 221 acks �retrans reqs for illegal seq : 2 �dropped updates as a result of sync overload: 3 ``` | * TOTAL number of sync packets is non-zero and increasing. * QUEUED value never decreases - a non-zero value does not indicate a problem. * DROPPED BY NET number may indicate network congestion - this counter is incremented when the cluster member receives a sync packet with a sequence number, which is higher, than the expected sequence number; meaning, packets with lower sequence numbers where lost somewhere along the way, and we should find out where. * RETRANS REQS growing very fast may indicate that the load is becoming too high. * RETRANS REQS FOR ILLEGAL SEQ may indicate a sync problem. * DROPPED UPDATES AS A RESULT OF SYNC OVERLOAD - in a heavily loaded system, the cluster member may drop synchronization updates sent from peer cluster member. | | ``` Delta Sync memory usage: currently using XX KB mem ``` | This statistic only appears for a non-zero value. It requires memory only while Full Sync is occurring. At other times, Delta Sync requires no memory. | | ``` Callback statistics: handled 138 cb, average delay : 2, max delay : 34 ``` | This statistic only appears for a non-zero value. AVERAGE DELAY should be \~1-5 packets, otherwise indicates an overload of sync traffic. | | ``` Number of Pending packets currently held: 1 ``` | This statistic only appears for a non-zero value. | | ``` Packets released due to timeout: 18 ``` | This statistic only appears for a non-zero value. If the number is large (more than 100 pending packets), and the "`Number of Pending packets currently held`" is small in the output of '`cphaprob syncstat`' command, you should take action to reduce the number of pending packets. To tackle this problem, see "Reducing the Number of Pending Packets" in ClusterXL Administration Guide. | **Related Solutions:** * [Cluster Control Protocol Reference](http://supportcontent.checkpoint.com/documentation_download?id=10336) (applies to all existing cluster versions) * [sk34475 - ClusterXL Sync Statistics - output of 'cphaprob syncstat' command](http://supportcontent.checkpoint.com/solutions?id=sk34475) (applies to R80.20 and higher). * [sk43896 - Blocking New Connections Under Load in ClusterXL](http://supportcontent.checkpoint.com/solutions?id=sk43896) * [sk41471 - ClusterXL - State Synchronization time interval and 'fwha_timer_sync_res' kernel parameter](http://supportcontent.checkpoint.com/solutions?id=sk41471) * [sk43872 - ClusterXL - CCP packets and 'fwha_timer_cpha_res' kernel parameter](http://supportcontent.checkpoint.com/solutions?id=sk43872) * [sk82080 - /var/log/messages are filled with 'kernel: FW-1: fwldbcast_update_block_new_conns: sync in risk: did not receive ack for the last 410 packets'](http://supportcontent.checkpoint.com/solutions?id=sk82080) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content