topic Re: VSX - Single Virtual System abnormal use of RAM in Firewall and Security Management

VSX - Single Virtual System abnormal use of RAM

Supporto_Checkp — Wed, 30 Nov 2022 20:05:37 GMT

Hi

I've a VSX Cluster ( simple HA beacuse the customer """"doesn't trust"""" VSLS ..... ) with R80.40 Take 180, this node is a 15400 with 24gb ram

This Cluster hosts 29 virtual firewall ; each one is not heavily loaded ; they are limited to 4000 connection but have peaks of 600,

One of them ( VS 22 ) is using a lot of ram compared to the others

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ P COMMAND

5027 admin 0 -20 5858644 4.470g 68604 S 1.0 **19.3*** 18:48.70 2 **fwk22**_dev_0

11572 admin 0 -20 3474088 2.192g 595908 S 5.9 9.4 161:28.40 10 fwk0_dev_0

11558 admin 20 0 674568 658216 466092 S 0.0 2.7 0:00.88 3 fwk_forker

1926 admin 0 -20 1746652 574500 101184 S 1.0 2.4 193:13.77 1 fwk29_dev_0

5003 admin 0 -20 1570108 398056 90040 S 2.0 1.6 26:27.92 2 fwk16_dev_0

5084 admin 0 -20 1553780 381844 89584 S 1.0 1.6 22:25.49 3 fwk20_dev_0

5078 admin 0 -20 1547356 374484 88764 S 1.0 1.5 9:20.74 3 fwk10_dev_0

VS22 is not under heavy load ...

I've tried switching the cluster but the active node start allocating a lot of ram to VS22 ...
the same after a reboot...it start with a normal allocation and slowly increase and increase and increase....two days ago this VS used all the ram ...leaving only 97 MB free ...( I had to reboot the node )
The only active blade on that VS the Firewall Blade ,there are 30 policies and 10 manual nat...nothing strange.

Any advice? thx! 🙂

I forgot to say that even today we had a little use of swap ...almost 170MB,but before the reboot when I had the "97mb situation" it used swap file for almost 2300MB

Re: VSX - Single Virtual System abnormal use of RAM

Bob_Zimmerman — Wed, 30 Nov 2022 19:49:29 GMT

97 MB free measured how? That sounds about right for a healthy Linux system measured via 'free -h' or 'top'.

Re: VSX - Single Virtual System abnormal use of RAM

Supporto_Checkp — Wed, 30 Nov 2022 20:04:26 GMT

I used cpview

it wasn't fine , it was swapping a lot ,over 2300mb of swap.

Re: VSX - Single Virtual System abnormal use of RAM

PhoneBoy — Wed, 30 Nov 2022 22:15:42 GMT

Sounds like a possible memory leak.
Please open a TAC case if you haven’t already.

Re: VSX - Single Virtual System abnormal use of RAM

Chris_Atkinson — Thu, 01 Dec 2022 01:05:27 GMT

For information the 15400s RAM can also be expanded where required, this may provide some longevity / short term mitigation whilst you investigate other possible causes.

Re: VSX - Single Virtual System abnormal use of RAM

Supporto_Checkp — Thu, 01 Dec 2022 08:18:23 GMT

I know,but this is not an answer ...and should not be an advice., we don't find ram modules under the pillow..

extra ram need extra money and time to receive it and install it .

Re: VSX - Single Virtual System abnormal use of RAM

Chris_Atkinson — Thu, 01 Dec 2022 08:23:01 GMT

Indeed, the quickest path to resolution is to investigate with TAC.

Re: VSX - Single Virtual System abnormal use of RAM

Martin_Hofbauer — Thu, 01 Dec 2022 14:28:23 GMT

We had a very similar thing,

In our case ( also VSX), we experienced a hanging Python script ("ifi_server" ).

see also

https://community.checkpoint.com/t5/Security-Gateways/Memory-Lost-from-40GB-Free-64GB-to-1GB-in-one-hour/m-p/141941

you can also see it with "hcp" under "Top user-space processes (aggregated by name)"

Re: VSX - Single Virtual System abnormal use of RAM

Chris_Atkinson — Thu, 01 Dec 2022 14:56:17 GMT

To my knowledge this issue would only be relevant where AV/TE is enabled.

Re: VSX - Single Virtual System abnormal use of RAM

Supporto_Checkp — Thu, 01 Dec 2022 15:01:59 GMT

nothing similar ,really simple firewall with only the firewall blade