topic Re: R80.10 threat extraction high cpu usage in Firewall and Security Management https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3429#M14253 <HTML><HEAD></HEAD><BODY><P>No not yet, I thought I may find an answer here before raising with tac</P></BODY></HTML> Sat, 20 May 2017 20:52:08 GMT David_Robinson 2017-05-20T20:52:08Z R80.10 threat extraction high cpu usage https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3427#M14251 <HTML><HEAD></HEAD><BODY><P>hi,</P><P></P><P>ive been testing R80.10 with all blades enabled and 2 or 3 days ago I noticed high cpu usage on a 'cat' process in top, to the point where I'm now unable to push policy.</P><P></P><P>i used pstree to identify the parent process being scrubd, which after a little research found it related to threat extraction.</P><P></P><P>I dad manage to successfully push policy if I killed the 'cat' processed with 'kill -9'. </P><P></P><P>Removing the threat extraction blade restores cpu usage to&nbsp; normality.</P><P></P><P>i took a migrate export and tried importing the backup to a vm to see if the issue arose, unfortunately it did.</P><P></P><P>does anyone have any ideas on how I can fix this without rebuilding from scratch?</P><P></P><P>thanks</P><P>Dave</P></BODY></HTML> Fri, 19 May 2017 21:26:29 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3427#M14251 David_Robinson 2017-05-19T21:26:29Z Re: R80.10 threat extraction high cpu usage https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3428#M14252 <HTML><HEAD></HEAD><BODY><P>Have you opened an SR with TAC on this issue?</P></BODY></HTML> Sat, 20 May 2017 20:48:25 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3428#M14252 PhoneBoy 2017-05-20T20:48:25Z Re: R80.10 threat extraction high cpu usage https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3429#M14253 <HTML><HEAD></HEAD><BODY><P>No not yet, I thought I may find an answer here before raising with tac</P></BODY></HTML> Sat, 20 May 2017 20:52:08 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3429#M14253 David_Robinson 2017-05-20T20:52:08Z Re: R80.10 threat extraction high cpu usage https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3430#M14254 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P></P><P>I am experiencing the exact same issue. SmartConsole reports Threat Extraction blade is unresponsive, there is a "/bin/cat /dev/urandom" process eating up 100% of one CPU core.</P><P>Doing a kill -9 on the process spawns a second similar one. Killing the second one stops the spawning, but renders Threat Extraction useless.</P><P></P><P>Did you happen to find any solution to this yet?</P><P></P><P>Thank you</P></BODY></HTML> Sun, 16 Jul 2017 19:38:28 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3430#M14254 Bogdan_Tatomir2 2017-07-16T19:38:28Z Re: R80.10 threat extraction high cpu usage https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3431#M14255 <HTML><HEAD></HEAD><BODY><P>Sorry for rushing in with the question. I found the culprit - <SPAN style="background-color: #ffffff; color: #000000; font-size: 14px;">Threat Extraction Web API.</SPAN></P><P><SPAN style="background-color: #ffffff; color: #000000; font-size: 14px;">Also there is a solution available at&nbsp;<SPAN>sk118353 .</SPAN></SPAN></P><P><SPAN style="background-color: #ffffff; color: #000000; font-size: 14px;"></SPAN></P><P><SPAN style="background-color: #ffffff; color: #000000; font-size: 14px;"><SPAN>For me it fixed the issue. Hope this helps!</SPAN></SPAN></P></BODY></HTML> Sun, 16 Jul 2017 20:32:12 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3431#M14255 Bogdan_Tatomir2 2017-07-16T20:32:12Z Re: R80.10 threat extraction high cpu usage https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3432#M14256 <HTML><HEAD></HEAD><BODY><P>That's great to hear!</P><P><A href="https://community.checkpoint.com/migrated-users/46159">https://community.checkpoint.com/people/dave.45cc086d-5044-468e-82c2-8ee173df935e</A>‌ does this fix the issue for you?</P></BODY></HTML> Sun, 16 Jul 2017 20:46:22 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3432#M14256 PhoneBoy 2017-07-16T20:46:22Z Re: R80.10 threat extraction high cpu usage https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3433#M14257 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>Since my setup was in a lab environment I decided to rebuild it clean and configure it as a distributed config rather than a stand-alone.</P><P></P><P>i have not had the issue so far.</P></BODY></HTML> Sun, 16 Jul 2017 21:26:42 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-10-threat-extraction-high-cpu-usage/m-p/3433#M14257 David_Robinson 2017-07-16T21:26:42Z