> Source: [sk42041](https://support.checkpoint.com/results/sk/sk42041)

# sk42041 - Security Status Diagram

| Property | Value |
|----------|-------|
| Solution ID | sk42041 |
| Date Created | 2009-06-10 |
| Last Modified | 2014-12-10 |
| Technical Level | General |
| Products | Security Gateway, SmartConsole |
| Versions | R82.10, R82, R81.20, R82.20 |

## Solution

**How does the Security Status Diagram works**   

* **Collecting attack counters**   

  Statuses are collected on IPS/IPS-1 logs on each Log Server and stored in dedicated history tables. The logs are counted as they arrive from the gateways, according to their severity and their respective action (detect / prevent).   

  There are two sets of counters - one for the last hour (short time frame), and the other is for the longer time frames. The hour counters are updated every minute. The longer time frame counters are updated every 30 min.   

* **Collecting average counters**   

  Average counters too are collected on each Log Server and they're based on the history period of up to 120 days. They're recalculated every minute.   

* **Displaying the diagram**   

  When displaying the Security Status Diagram overview page, the Security Management server collects the counters from all available log servers. Each Log Server responds by sending the respective counters to the Security Management server.   
  The Security Management server adds up the answers from all log servers and sends them for the SmartDashboard to show.   

* **Refreshing the diagram**   

  There is no automatic refresh. To refresh the diagram, click the "Refresh" link at the bottom.  

* **Resetting the counters**   

  As counters are collected on each Log Server separately, there's no way to reset them centrally. To reset counters on specific Log Server, administrator should do the following:   

  1. Run cpstop  

  2. Delete the *CPEPSTableDB_1.3.6.1.4.1.2620.1.9005\** and *CPEPSTableDB_1.3.6.1.4.1.2620.1.9006* \* database files from the */opt/CPshrd-FLI/database/cpeps* directory.  

  3. Run cpstart

  <br />

  **Note:**If gateways send logs to more than one Log Server, attack counters will not reflect real situation. This is due to the fact that each log will be accounted on each Log Server, thus as attack counter is then summed up on Security Management server, final result will be increased by 1 for each Log Server that received the log, for each log. Though, average counters will reflect correct picture.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content