topic Re: Ted.elg increased a lot in Firewall and Security Management

Ted.elg increased a lot

BrunoCiongoli — Tue, 29 Mar 2022 16:46:20 GMT

Hi checkmates, I have a problem:

The file "ted.elg" increase a lot and this fills the disk in the active gateway. The Threat Emulation and Threat Extraction blades are not enabled.

We are running a cluster in R80.40

This appears in the ted.elg file (attached image)

Did anything like that happen to anybody else?

Re: Ted.elg increased a lot

the_rock — Tue, 29 Mar 2022 18:38:34 GMT

Hey Bruno,

Cant say I ever seen that issue happen myself. Can you ensure there is nothing in threat prevention policy enabled for those blades? I checked my 2 lab fw's and both have this file with size less than 200 Kb.

Andy

Re: Ted.elg increased a lot

BrunoCiongoli — Tue, 29 Mar 2022 20:46:19 GMT

Hi andy thanks for the response

No, nothing in threat prevention policy is installed on this GW

regards

Re: Ted.elg increased a lot

the_rock — Tue, 29 Mar 2022 20:47:28 GMT

Can you send a screenshot?

Andy

Re: Ted.elg increased a lot

BrunoCiongoli — Tue, 29 Mar 2022 20:56:04 GMT

Yes, of course

This TP policies are for another cluster and are instaled on that cluster. The GW what have this issue is the one in the other image

Re: Ted.elg increased a lot

the_rock — Tue, 29 Mar 2022 21:00:36 GMT

What happens if you delete the file? Does it go back to unusual size after some time?

Re: Ted.elg increased a lot

BrunoCiongoli — Tue, 29 Mar 2022 21:13:03 GMT

Yes, after delete this file it returned to unusual sizes and again fills the disk after some time, it never stops typing it with the same error ( the error of the image that I sent in the original post)

Re: Ted.elg increased a lot

the_rock — Tue, 29 Mar 2022 21:16:04 GMT

As last resort, if you can reboot fw, try that. If not, I would suggest contact TAC, this is worth investigating more.

Re: Ted.elg increased a lot

BrunoCiongoli — Tue, 29 Mar 2022 22:43:58 GMT

We reboot the cluster and the problem happened in the another cluster member too.

Re: Ted.elg increased a lot

the_rock — Tue, 29 Mar 2022 22:47:06 GMT

Definitely get in touch with TAC.

Re: Ted.elg increased a lot

BrunoCiongoli — Tue, 29 Mar 2022 22:50:40 GMT

Thanks for your time, we’ll open a case

Re: Ted.elg increased a lot

the_rock — Tue, 29 Mar 2022 22:56:39 GMT

Im really sorry, I wish I could have given you some sort of good suggestion. I never seen this problem before, so not really sure why it happens. Maybe someone else in the community will have an idea...one thing though that came to my mind is, can you run ps -auxw command and top as well, just to see if there is a process that could be consuming high memory/cpu that might potentially cause this to happen?

Andy

Re: Ted.elg increased a lot

BrunoCiongoli — Tue, 29 Mar 2022 23:11:27 GMT

Here are the outputs

Re: Ted.elg increased a lot

the_rock — Tue, 29 Mar 2022 23:18:50 GMT

Just a shot in the dark here...but, one that that struck me from those outputs is that fwd is consuming unusually high amount of cpu, 30 plus % and then all fw workers about 10% each, which amount to more than 60% right there. I know this might be a bit extreme to try, but just to be 100% positive its not corexl related, if its enabled, I would try disable it as a test and reboot (can be done via cpconfig command). Not sure if thats something you could try, but it would be worth, just to confirm, for sure.

Re: Ted.elg increased a lot

JeffersonRomero — Fri, 26 Aug 2022 20:04:06 GMT

Hi Bruno

Did you solve it? I have the same behavior in a cluster in R81.10 ...

Regards

Re: Ted.elg increased a lot

Chris_Atkinson — Sat, 27 Aug 2022 04:06:39 GMT

TE is not enabled?

Does the following command return output?

tecli advanced attributes show | grep -i log

Re: Ted.elg increased a lot

Shiran_Gold — Mon, 29 Aug 2022 07:12:14 GMT

Hi Jefferson,

I have sent you a direct message, please check your inbox.

I would like to get more details about the behavior.

BR,

Shiran