topic Re: RAD's high utilization in Firewall and Security Management

RAD's high utilization

Hllrdm — Mon, 14 Mar 2022 13:28:23 GMT

Hello.

We at the Security Gateway have found that our RAD process loads the CPU heavily.
Is there any debugging of this process to understand why it loads the CPU?
Maybe we can look at the buffer?

Re: RAD's high utilization

Chris_Atkinson — Mon, 14 Mar 2022 13:59:52 GMT

From R80.40 RAD is multi-threaded, you will see more RAD processes, and CPU can exceed 100%. Within reason this is a usual behavior.

If you're seeing excessive numbers (500%) see sk167553 section 4.7.4

Re: RAD's high utilization

Hllrdm — Mon, 14 Mar 2022 13:52:55 GMT

Is there any confirmation in sk or additional documentation that says this is expected behavior?

Re: RAD's high utilization

Chris_Atkinson — Mon, 14 Mar 2022 14:07:40 GMT

Source sk163793 but as above if it's really high please review the other reference SK provided. Might require anti-malware cache tuning etc.

If the issue persists there after please contact TAC.

Re: RAD's high utilization

Hllrdm — Mon, 14 Mar 2022 14:13:31 GMT

Thank you. Could you please tell us how we can view the buffer of this process. We have a suspicion that our buffer is full, because the mode is hold

Re: RAD's high utilization

Chris_Atkinson — Mon, 14 Mar 2022 14:29:04 GMT

For the various services leveraging RAD please see the commands in sk105179 (AV/AB) & sk64280 / sk90422 (URLF).

Re: RAD's high utilization

Hllrdm — Tue, 15 Mar 2022 07:11:40 GMT

Unfortunately, I could not find a command to check the buffer for the RAD service. Have you come across such a need?

Re: RAD's high utilization

G_W_Albrecht — Tue, 15 Mar 2022 07:51:18 GMT

See sk90422 - How to modify URL Filtering cache size?

Re: RAD's high utilization

Chris_Atkinson — Tue, 15 Mar 2022 09:14:20 GMT

The knowledge base article IDs I provided include these commands.

Please explain what you are attempting to check more clearly?

Re: RAD's high utilization

Hllrdm — Mon, 21 Mar 2022 07:11:05 GMT

Can you tell me how to remove the hold action for entries in the RAD process? Our records also have a hold action.

Re: RAD's high utilization

Chris_Atkinson — Tue, 22 Mar 2022 10:34:28 GMT

What is the actual problem (user symptom) that you're trying to troubleshoot and is TAC engaged?

1.) Manage & Settings > Blades > Application Control & URL Filtering > Check Point online web service > Website categorization mode: Hold / Background / Custom.

2.) Manage & Settings > Blades > Threat Prevention > Check Point Online Web Service > Resource classification mode: Hold / Background / Custom.