> Source: [sk52780](https://support.checkpoint.com/results/sk/sk52780)
# sk52780 - Viewing and analyzing a CPInfo output file in InfoView
| Property | Value |
|----------|-------|
| Solution ID | sk52780 |
| Date Created | 2010-08-19 |
| Last Modified | 2026-03-22 |
| Technical Level | General |
| Products | Tools |
| Versions | Not Version-Specific |
| OS | Windows |
## Solution
**Note: InfoView is obsolete. [DiagnosticsView](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk125092) is the recommended tool.**
**Table of Contents**
---------------------
* Overview
* Download
* Basic actions
* Viewers
* Advanced actions
* Analysis pane
* Icon legend
* Data tree
* Disabling SmartMap
* InfoView for Multi-Domain Management / Provider-1 (pInfoView)
* Configuring InfoView to use a specific text editor
* Troubleshooting
* Related Solutions
Click Here to Show the Entire Article
Overview {#Overview}
--------------------
The InfoView utility lets you view and analyze a CPinfo output file collected from a Check Point server.
* The left pane shows the data tree, which holds a hierarchical list of input data, consisting of file and directories, in addition to other text sections.
* The right pane shows a list of tests that can be applied on the input files.
Download {#Download}
--------------------
|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Package | Download Link |
| **InfoView** | [](http://supportcontent.checkpoint.com/file_download?id=8227) (ZIP) |
Basic actions {#Basic actions}
------------------------------
* **View file/text section**
There are 3 ways to open a text file or a text section:
* Double-click the text file/section.
* Right-click the text file/section and select 'Open'.
* Drag and drop the text file/section into an open window of any text editing software (e.g., Notepad, Word).
**Note**: With the first 2 options, the file will open in your operating system's default text editing program. You can configure InfoView to use a specific text editor instead.
* **Copy file/text section/folder**
You can copy a text file, text section, or folder to any Windows folder directly from InfoView. To do this, either drag and drop the file/folder, or copy and paste it.
* **View the Policy in the Policy Viewer (SmartDashboard/SmartConsole)**
To better understand the gateway's set-up, and especially the policies, InfoView lets you view the CPInfo information in SmartDashboard on your desktop.
**Note**: This is possible only if the CPInfo output file is from Security Management server or Standalone. Policy Viewer is not supported for CPinfo file collected on Multi-Domain Security Management server.
1. Make sure you have the corresponding customer version of SmartConsole installed.
2. In InfoView, click on the **`Policy Viewer`** button (see in above picture), or select **`Tools`** -\> **`Policy`** from the main menu.
It might take a few minutes for SmartDashboard to show.
3. **To view policy of R80 and above machine** , a Virtual Machine (VM) should be prepared with the same machine version as where CPinfo data was collected.
CPinfo on R80 and above Security Management machine creates two files:
* *\*.info file* (CPinfo file)
* *\*_ migrate_export_out.tgz* file (database export file).
4. When clicking on the **`Policy Viewer`** button, the following dialog box will be displayed to specify VM credentials and Database export file.
**Note** : If Database export file is located in the same folder as CPinfo file, InfoView will automatically detect it.
Clicking on **OK** will start VM preparation by importing the specified Database file. It might take a long time to complete.
Once VM is ready, SmartConsole will be launched.
Viewers {#Viewers}
------------------
|-----------------------------------------------------------------------------------------------------|---------------------------------------------|
|  | Info Tab - Kernel table viewer |
|  | IKEView |
|  | LicView - Check Point License string viewer |
|  | Process Viewer |
Advanced actions {#Advanced actions}
------------------------------------
* **Tree sorting**
There are 2 sorting options for the data tree:
*  - Alphabetically.
*  - By file size.
* **Tree searching**
To search for text in the data tree, either click the 'Find' button on the main toolbar, or use the keyboard shortcut Ctrl+F.
Click the 'Find next' button, or press F3 to repeat the previous search.
* **Export Object File**
You can remove all certificate keys from the object file (`objects_5_0.C`) that is imbedded in the input file. To do this, from the main menu, select 'File' \> 'Export object file (fresh CA)' and save the new file.
Analysis pane {#Analysis pane}
------------------------------
The right pane of InfoView is dedicated to analysis. Here you can see a list of tests that you can run on the input file, as well as the status and results of the tests.
To run a test, either double-click it, or select it and press the 'Test' button.
To see the test results after it has finished running, either double-click it, or select it and press the 'View' button.
Possible test statuses:
|----------------|-------------------------------------------------|
| **OK** | Test Passed |
| **Suspicious** | Possible problem (test this issue manually) |
| **Irrelevant** | This test is irrelevant to the given input file |
| **Not Tested** | This test has not been executed yet |
Icon legend {#Icon legend}
--------------------------
|--------------------------------------------------------------------------------------------|-----------------------------------------|
|  | Text section |
|  | Text file |
|  | Text file (Unavailable - not collected) |
|  | Text file (Soft Link) |
|  | Text file (Registry) |
|  | Text File (WinMSD) |
|  | Folder |
|  | Root Icon - Firewall is installed |
|  | Root Icon - Meta IP is installed |
|  | Root Icon - Provider-1 is installed |
|  | Root Icon - SecureClient is installed |
Data tree {#Data tree}
----------------------
* **Server Information**
To see the server information, right-click the server name (the root of the tree) and select 'Properties'.
Here you can see the server version, if the server is a Security Gateway or Security Management and more.
* **$FWDIR directory**
The tree shows the `$FWDIR` directory collected by the CPInfo utility from the server. Here you can find some useful files, such as:
* In the `conf` directory:
* `objects_5_0.C` - Full database objects file.
* `fwauth.NDB` - All users the administrator defined on the SmartDashboard.
* `fwauthd.conf` - Configuration file of the Security Servers.
* `asm.C` - IPS configuration file.
* `classes.C` - Definitions of the fields in the Check Point Database files.
* In the `log` directory:
* `fwd.elg` - fwd process log file. In the output file, you can find any messages that may have occurred on or about the time a problem was identified. Dates are associated with messages in the file.
* `fwm.elg` - fwm process log file.
* In the `database` directory, you can see all of the relevant policy files for the Security Gateway.
* **$CPDIR directory**
The tree shows the `$CPDIR` directory collected by the CPInfo utility from the server.
Here you can find some useful files, such as:
* In the `log` directory:
* `cpd.elg` - CPD log file. Shows useful information about SIC related issues, CP WatchDog log files (`cpwd.elg`), processes crashes and more.
* In the `registry` directory:
* `HKLM_registry.data` - Shows all products and fixes installed on the system.
* **Other items on the data tree:**
* CP components - Shows overview information about the products installed on the system (such as Acceleration \[PPACK\], Advanced routing \[ADVR\], etc.). Might be useful for comparing cluster members.
* CP Status - Shows policy name and install time, FW connections and packet statistics (per interface as well).
* FireWall-1 Version Information - Shows the FW \& OS patch level including HFAs.
* System Information:
* `date` - Date and time on the machine when the CPInfo was collected (useful for sync issues and logs referral).
* `ethtool `** - Interface configuration and status.
* `ethtool -i `** - Interface driver version.
* `uname -a` - OS information, date of OS kernel compilation.
* `uptime` - When the system was last rebooted.
* `ps auxww` - Processes list (CPU/Memory consumption, PID, full process path).
* `vmstat 1 10` - Machine CPU consumption. User/Kernel space (`us` = user space, `sy` = kernel space, `id` = idle).
* `top -n 2` - System resources usage. Overview: system (kernel), user, softirq (CPU software interrupts), iowait (HD operation), memory usage status, and processes list (as in `ps auxww`).
* `env` - Environment variables.
* `df -k` - Hard disk space information.
* Package Manager Report (RPM) - Output of `rpm -qa` command - list of installed RPMs.
* List PCI devices (`lspci -nv`) - list of hardware devices. Class 0200 stands for Interface Card (NIC). Class and Subsystem information will assist you to identify the exact NIC model in the [PCI IDs list](http://pciids.sourceforge.net/pci.ids). Check the [Check Point Hardware Compatibility List](https://www.checkpoint.com/support-services/hcl/) to make sure the NIC is supported.
* Interrupts Information (`/proc/interrupts`) - Hardware device per IRQ list.
* Memory Information (`free -k -t`) - Free memory available. Calculated as the sum of the 'free' + 'buffers' + 'cached' on the first line of the command output.
* Loaded Modules (`lsmod`) - List of kernel modules currently loaded (FW, VPN, acceleration kernel modules, interface drivers, etc).
* Additional Memory Information (`meminfo`) - Output of `cat /proc/meminfo`. for additional memory details such as 'HighTotal' \> high kernel memory allocated by the OS during reboot.
* Additional CPU Information (`cpuinfo`) - Output of `cat /proc/cpuinfo`. Specifies the CPU vendor and model, and number of processors.
* System's Hardware - Server vendor and model details, bios details.
* IP Interfaces:
* `ifconfig -a` - Full details about the interfaces: MAC, MTU, IP, Mask, etc. Can assist in identifying the master in a VRRP cluster (only the master has 'vrrpmac' addresses in this output.
* `fw ctl iflist` - Interfaces mapping to the IDs given by the OS during boot. In the kernel debug's output, the interfaces are identified with those IDs, instead of the interfaces' names.
* `fw getifs` - Summary display of IP addresses per interface.
* Netstat Information:
* `netstat -rnv` - Full routing table (for routing/advanced routing troubleshooting, cluster members comparison).
* `netstat -i` - Interface packets statistics, RX/TX drops and errors per interface.
* `netstat -s` - OS statistics per protocol (ICMP, IP, UDP, TCP).
* `netstat -nap` - List of open (listening) ports per process, and established connections per process (helps to identify which process is occupying each port at the time the CPInfo was collected).
* `arp -a` - ARP table output. Use the MAC addresses to crossover information with traffic captures. If the word "Incomplete" is shown in the output file, it may be an indication that automatic ARP is not working.
* FW-1 Accelerator - Acceleration device (SecureXL/PPACK) status, build, statistics, accelerated connections and SIM affinity information. "accel packets"/"F2F packets" ratio will give you indication regarding acceleration efficiency. SIM affinity customization can increase performance as well - see [sk33506](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk33506).
* FireWall-1 Tables - Short Format - Output of `fwtab -t `**` -s`, list of all kernel tables (connections table \['`connections`', ID 8158\], NAT table \['`fwx_alloc`', ID 8187\], etc) and current value of each table (`#VALS` column).
* FireWall-1 Statistics (`fw ctl pstat`) - The last parameter in the output file is State Sync (used for Cluster troubleshooting). It shows '`off`' when it is off, and shows packets statistics when it is on.
* FireWall-1 Debug (`fw ctl debug`) - Shows which kernel debug flags are on.
* FireWall-1 Chain/Connections Modules - Output of '`fw ctl chain`' / '`fw ctl chain connections`', list of loaded FW chains (corresponds with installed products). Must be identical between cluster members.
* Overlapping Encryption Domains - Might cause VPN related issues.
* High Availability - Clustering-related information:
* High Availability State (`cphaprob state`) - Indicates the cluster mode, the status of the cluster member itself and how this cluster member perceives the status of other cluster members. View and compare statuses of each cluster member.
* High Availability -i list (`cphaprob -i list`) - View a Pnote "device" that may be in a problem state. Cluster member status is 'down' when a Pnote is in 'Problem' state.
* High Availability interfaces (`cphaprob -a if`) - This output file shows the status of the interfaces for that cluster and VIP addresses, and CCP mode of the interfaces. The number of "Required interfaces" (determined during boot) and the CCP mode (multicast/broadcast) must be the same on both members.
* High Availability SyncStat (`cphaprob syncstat`) - Synchronization statistics - refer to Cluster Admin Guide for output analysis in order to tell if there is a sync related problem.
* VSX Information (CTX 0) \[on a VSX machine\] - Contains information about the CTX IDs (VS IDs), status and policy details of the VSX physical box and of the Virtual Devices.
* CP License - Output of `cplic print`, license information. Using the wrong license might cause unexpected behavior.
* CPWD (Watch Dog) information - Output of `cpwd_admin list`, list of all processes monitored by CP Watchdog and their status.
* `DLL_EXEC_Kernel` versions - Current builds of system files. You can use this information to check the current builds and to verify if provided Hotfix replaced the files it should:
* DLL versions - Current build of library files (`$FWDIR/lib`).
* EXEC versions - Current build of binary files (`$FWDIR/bin`).
* Kernel versions - Current build of kernel modules files (`$FWDIR/boot/modules`).
* `/var/log/messages`:
* When no buffer is defined in kernel, system messages are sent directly to the OS.
* We refer to these as "console messages" since in most OSs the messages are printed to the console and copied to `/var/log/messages` or `/var/adm/messages`.
* This is why error messages (which are generated out of debugging context) are sent to the console.
* When generated in debugging context, error messages are not directed to the console but to the debug buffer, together with all other messages.
* On Windows OS, "console messages" in fact appear in the event viewer.
* `/var/log/routing_messages` - Advanced routing error messages, search for errors when troubleshooting dynamic routing (GateD) related issues.
* `/etc/resolv.conf` - DNS configuration file.
* `/etc/hosts` - IP address per hostname mapping. In a cluster environment, misconfiguration of this file might cause unexpected behavior. See [sk42952](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk42952).
* `/etc/sysconfig/ethtab` - Interface name per MAC address, OS mapping.
* `/etc/sysconfig/netconf.C` - OS interfaces and routing configuration file. Compare it to /etc\\sysconfig/ethtab when troubleshooting IP/MAC address mismatches.
Disabling SmartMap before launching the Policy Viewer {#Disabling SmartMap}
---------------------------------------------------------------------------
SmartMap can make SmartDashboard crash or hang for a long time before SmartDashboard launches from InfoView.
To disable SmartMap:
1. Backup the current CPinfo file.
2. Edit the current CPinfo file using an advanced text editor (Vi, Notepad++, UltraEdit, PSPad, etc.).
3. Find and replace all instances of "*totally_disable_VPE*":
from `totally_disable_VPE (false)`
to `totally_disable_VPE (true)`
(The value is defined in the `$FWDIR/conf/object_5_0.C` file.
Refer to [sk34973 - How to completely disable Visual Policy Editor or SmartMap](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk34973)).
4. Save the changes.
5. Open the modified CPInfo file in InfoView.
InfoView for Multi-Domain Management / Provider-1 (pInfoView) {#InfoView for Provider-1 / Multi-Domain (pInfoView)}
-------------------------------------------------------------------------------------------------------------------
Use the **`pInfoView`** tool to view a CPInfo output file collected from a Provider-1 server (MDS level).
* The Left pane shows a list of all of the CMAs, arranged under the MDS. The grayed out CMA icons represent CMAs that were not collected by the CPInfo utility.
* The consists of two sub-panes:
* The left sub-pane shows the data tree, which holds a hierarchical list of input data, consisting of file and directories, in addition to other text sections.
* The right sub-pane shows a list of tests that can be applied on the selected MDS/CMA.
**Icon legend**
In addition to the icons that are listed above, `pInfoView` includes these 3 icons:
|-------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|
|  | MDS - Selecting this icon changes the context of the right pane to MDS |
|  | CMA - Selecting this icon changes the context of the right pane to this CMA |
|  | CMA (Unavailable) |
Configuring InfoView to use a specific text editor {#Configuring InfoView to use a specific text editor}
--------------------------------------------------------------------------------------------------------
1. Open InfoView.
2. Go to '**`View`** ' menu - click on '**`Options...`**'.
3. On the '**`General`** ' tab, go to '**`File Editor`** ' section - select '**`User Defined`**'.
4. Click '**`Browse`**' and select your preferred text editor.
5. Click '**`OK`**'.
Troubleshooting {#Troubleshooting}
----------------------------------
Click Here to Show this Section
* Scenario 1: InfoView application fails with "*Cannot find Infoview home directory*" error
> Symptoms: InfoView application fails with "*Cannot find Infoview home directory*" error
>
> Cause: InfoView application was not run with Administrator permissions.
>
> Solution:
> > Launch the InfoView application as an Administrator (right-click - 'Run as administrator').
* Scenario 2: "*\[Error 61845\]* " and "*\[Error 61490\]*" in InfoView when opening a CPinfo file
> Symptoms:
> > 1. Immediately after opening a CPinfo file, the following error appears:
> >
> > `[Error 61845]`
> > ` Cannot open file due to corrupted header section`
> > ` This is probably not a valid CPinfo/FWinfo file `
> > 
> > 2. After clicking on OK, the following error appears:
> >
> > `[Error 61490]`
> > ` This file does not begin with a valid header`
> > ` Verify that this is a valid CPinfo file `
> > 
>
> Cause:
> > InfoView utility expects that the CPinfo file starts with the following header:
> >
> > ```
> > ************************************************************************
> > Check Point Support Information.
> > CPinfo 5.0 Build ...
> > ... ...
> > ```
> >
> > If any text (except for white space) appears before the expected header, then InfoView considers this CPinfo file as corrupted.
> >
> > Such issue usually occurs when the "*cpinfo* " command is executed without the "*-o File_Name* " argument.
> > As a result, the CPinfo information is printed on the screen, from where it is copied-and-pasted into a file.
>
> Solution:
> > The following two options exist:
> > * If your advanced text editor (Vi, Notepad++, UltraEdit, PSPad, etc.) is able to work with such large files, then edit the involved CPinfo file - delete all lines that appear above the expected header. Save the changes.
> >
> > * Collect the CPinfo file with the "*-o File_Name* " argument (refer to [sk92739](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739)).
* Scenario 3: "*caught exception Cannot allocate memory for inBuf*" error in InfoView when opening a CPinfo file
> Symptoms:
> > When opening a CPinfo file, the following error appears:
> >
> > `caught exception Cannot allocate memory for inBuf`
>
> Cause:
> > The "Core Dumps" information in the CPinfo file is saved as a subsection without a section title above it:
> >
> > ```
> > ------------------------
> > Core Dumps
> > ------------------------
> > ```
>
> Solution:
> > This problem was fixed. The fix is included in:
> > * [The CPInfo utility](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) - since *build 91400110*
> >
> > The following manual ***workaround*** is also available:
> > 1. Backup the current CPinfo file.
> >
> > 2. Edit the current CPinfo file using an advanced text editor (Vi, Notepad++, UltraEdit, PSPad, etc.).
> >
> > 3. Change the "Core Dumps" title:
> >
> > from:
> > >
> > > ```
> > > ------------------------
> > > Core Dumps
> > > ------------------------
> > > ```
> >
> > to (there have to be 46 characters '=' in each line):
> > >
> > > ```
> > > ==============================================
> > > Core Dumps
> > > ==============================================
> > > ```
> >
> > 4. Save the changes.
> >
> > 5. Open the CPinfo file in InfoView.
* Scenario 4: "*The connection has been refused because the database could not be opened*" error from a SmartDashboard after clicking on the "Policy Viewer" icon in InfoView
> Symptoms:
> > 1. Open a CPinfo file in InfoView
> > 2. Click on the "Policy Viewer" icon
> > 3. SmartDashboard is launched
> > 4. SmartDashboard displays the "*The connection has been refused because the database could not be opened*" error
>
> Cause:
> > InfoView is not able to implicitly find the relevant SmartDashboard installation (Issue ID 01928489).
>
> Solution:
> > The following workaround is available:
> > 1. Open a CPinfo file in InfoView
> >
> > 2. Wait until the entire CPinfo file is loaded
> >
> > 3. Go to **`%TEMP%`** folder
> >
> > 4. Open the last modified folder named **`InfoView_`** folder
> > Note: Ignore the number in the folder's name - look only at the "Date modified"
> >
> > 5. In this folder, go to **`opt\CPsuite-R\fw1\conf`** subfolder
> >
> > 6. Create a copy of the file named **`new_scheme.C`**
> >
> > 7. Rename the copied file to **`InfoViewDB_new_scheme.C`**
> >
> > 8. In the InfoView, click on the **`Policy Viewer`** icon again
* Scenario 5: When opening a CPinfo file, InfoView stops responding at the stage of parsing the FireWall log files
> Symptoms:
> > 1. Open a CPinfo file in InfoView
> >
> > 2. When InfoView starts parsing the FireWall log files, it stops responding / hangs:
> >
> > * `*.log`
> > * `*.logaccount_ptr`
> > * `*.loginitial_ptr`
> > * `*.logLuuidDB`
> > * `*.logptr`
> > * `*.logtrack`
>
> Cause:
> > There are multiple rotated FireWall log files on the machine, on which the CPinfo file was collected.
> > Although these log files are not collected, their list is collected and has to be parsed.
> > If there are more than several hundred of such rotated FireWall log files on the machine, it may cause the InfoView stop responding / hang.
>
> Solution:
> > 1. Backup the current CPinfo file.
> >
> > 2. Edit the current CPinfo file using an advanced text editor (Vi, Notepad++, UltraEdit, PSPad, etc.).
> >
> > 3. Search for **`.logaccount_ptr`**
> >
> > 4. Delete all the lines with the names of rotated FireWall log files:
> >
> > * `.log`
> > * `.logaccount_ptr`
> > * `.loginitial_ptr`
> > * `.logLuuidDB`
> > * `.logptr`
> > * `.logtrack`
> >
> > Note: The same applies to the rotated Management Audit log files:
> > * `.adtlog`
> > * `.adtlogaccount_ptr`
> > * `.adtloginitial_ptr`
> > * `.adtlogptr`
> > 5. Save the changes.
> >
> > 6. Open the CPinfo file in InfoView.
* Scenario 6: "*Error occured while trying to copy local_plugins_list.C from Gui library*" error in InfoView when opening a CPinfo file
> Symptoms:
> > "*Error occured while trying to copy local_plugins_list.C from Gui library*" error in InfoView when opening a CPinfo file.
>
> Cause: Outdated CPinfo utility was used to collect this CPinfo file.
>
> Solution:
> > Install the latest CPinfo utility from [sk92739 - The CPinfo utility](http://supportcontent.checkpoint.com/solutions?id=sk92739).
Related Solutions {#Related Solutions}
--------------------------------------
* [sk92739 - The CPinfo utility](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739)
* [sk98615 - How to decrease the size of CPInfo output file?](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98615)
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content