topic Re: High CPU usage on security gateway after R80.10 Fresh install in Firewall and Security Management

High CPU usage on security gateway after R80.10 Fresh install

Silvan_Nyambu1 — Wed, 06 Sep 2017 07:37:20 GMT

Hi, i am having a distributed environment of one Smartcenter and one security firewall both running on R80.10, but previously they were both running on R77.30

I recently i did a fresh install of R80.10 on both the management and the Checkpoint 5400 security firewall but after like 5 days i started experiencing very High CPU usage on the firewall. When i check the processes running from the top command i found out that gzip process was the one consuming most of the firewall resources and no backup was being done at the moment.

I had a chat with one of Checkpoint technical engineers and told me to do a restart of the firewall and if it fails i do another fresh install of R80.10.

I did a restart of the firewall and the CPU usage came down but after a week it came up again. I therefore proceeded with doing a fresh install of R80.10 on the firewall but i was still experiencing the same issue.

Now i have downgraded the gateway to R77.30 and its working fine, the management is on R80.10. Still today i haven't found a solution for the previous problem. I experienced this problem with more than one client, others however were generating some error message codes when installing policies to the gateway which I've never seen before not even in support center.

If anyone has a solution to this i would really appreciate.

Re: High CPU usage on security gateway after R80.10 Fresh install

Timothy_Hall — Wed, 06 Sep 2017 12:32:23 GMT

Use the pstree command to identify the parent process of gzip as discussed in this thread:

https://community.checkpoint.com/message/7514-re-strange-processes-in-r8010-gw?commentID=7514?sr=search&searchId=a58c72e…

Next this sk will help you identify what feature/blade the offending process is associated with:

sk97638: Check Point Processes and Daemons

If I had to take a wild guess I'd say it is probably related to CPUSE (DAService process), archive scanning in the Anti-virus blade, or scheduled backups.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

Re: High CPU usage on security gateway after R80.10 Fresh install

cstueckrath — Wed, 06 Sep 2017 14:40:16 GMT

try pressing "c" while in top. It will show the command gzip was started with.

Re: High CPU usage on security gateway after R80.10 Fresh install

Laurent_Vanhees — Fri, 08 Dec 2017 09:55:50 GMT

Hello,

Do you have a solution?

We are experiencing the same issue. GZIP process is running at 100% and the load of the gateway is quite high.

No able to install policy anymore "problem with the commit function".

Thanks,
Regards,
Laurent

Re: High CPU usage on security gateway after R80.10 Fresh install

PhoneBoy — Sat, 09 Dec 2017 08:04:07 GMT

Test