topic Re: Checkpoint gateway Memory Usage in Firewall and Security Management

Checkpoint gateway Memory Usage

gemechisd — Thu, 09 Mar 2023 05:44:33 GMT

We have checkpoint security gateway 7000 appliance. Recently the memory usage is above 90%. How can we know, which process is running more memory?

Re: Checkpoint gateway Memory Usage

CheckPointerXL — Thu, 09 Mar 2023 08:41:00 GMT

free -h command?

Re: Checkpoint gateway Memory Usage

gemechisd — Thu, 09 Mar 2023 09:35:28 GMT

Do I have to be on Expert mode to run free -h?

Re: Checkpoint gateway Memory Usage

G_W_Albrecht — Thu, 09 Mar 2023 10:01:19 GMT

Look at the prodedure for memory here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98348&partition=Basic&product=Quantum#Initial%20diagnostics%20-%20Memory

Re: Checkpoint gateway Memory Usage

Chris_Atkinson — Fri, 10 Mar 2023 22:48:09 GMT

Also what do you see with the output from the "top" command?

Which version & Jumbo is the gateway installed with?

Note the 7000 series appliances can be upgraded to 64GB RAM where required. But first we should determine if the memory is consumed by a high number of connections or a memory leak etc?

Re: Checkpoint gateway Memory Usage

gemechisd — Fri, 10 Mar 2023 11:01:22 GMT

The output of top command is attached below

Re: Checkpoint gateway Memory Usage

nooni — Fri, 10 Mar 2023 13:11:14 GMT

Please post output of top and sorted by memory usage.

That is SHIFT+m when top is running

Re: Checkpoint gateway Memory Usage

the_rock — Fri, 10 Mar 2023 13:15:11 GMT

I would check below commands:

free -m

top

ps -auxw

cpview

cpwd_admin list

Re: Checkpoint gateway Memory Usage

gemechisd — Fri, 10 Mar 2023 13:16:08 GMT

Here it is

Re: Checkpoint gateway Memory Usage

the_rock — Fri, 10 Mar 2023 13:22:05 GMT

@gemechisd

Just to be 100% sure its not any debugs running in the background, can you issue below 2 commands, wait few mins and see if anything changes?

fw ctl debug 0

fw ctl debug -x

Cheers,

Andy

Re: Checkpoint gateway Memory Usage

gemechisd — Fri, 10 Mar 2023 13:37:45 GMT

What effect does this commands have?

Re: Checkpoint gateway Memory Usage

the_rock — Fri, 10 Mar 2023 13:44:29 GMT

It disables and turns off any debugs on the firewall that might be currently running.

Re: Checkpoint gateway Memory Usage

the_rock — Fri, 10 Mar 2023 13:48:31 GMT

To check debugs that could be on, you can refer to below and what Tim Hall suggested.

Andy

https://community.checkpoint.com/t5/General-Topics/How-to-check-debug-command/td-p/32373

Re: Checkpoint gateway Memory Usage

gemechisd — Fri, 10 Mar 2023 13:50:41 GMT

Okay. Does it have any effect on gateway at the moment if I run the commands you have listed?

Re: Checkpoint gateway Memory Usage

the_rock — Fri, 10 Mar 2023 14:07:25 GMT

100% does not have any effect. I ran it at least 200 times and never had an issue.

Re: Checkpoint gateway Memory Usage

gemechisd — Fri, 10 Mar 2023 16:25:12 GMT

So, what could the possible reason that can make the memory to run on 98%?

Re: Checkpoint gateway Memory Usage

the_rock — Fri, 10 Mar 2023 17:55:35 GMT

There can be many reasons. I would say, from my experience, its usually specific process thats causing it, or it simply could be firewall that does not have enough physical RAM, so has to use swap. It also could be amount of traffic, so thats why running those commands I sent you would give us pretty good idea.

You can also run -> tw ctl multik print_heavy_conn and it would show you connections that are heavily "utilized"

Hope that helps.

Andy

Re: Checkpoint gateway Memory Usage

the_rock — Fri, 10 Mar 2023 17:59:12 GMT

Also, to add to my last response, cpstat if really good command. If you run it, it will give you all the options. Idea is thia essentially -> run cpstat, then flag on the left, then -f then whatever word (flag_ on the right of the table

few examples:

cpstat fw -f all

cpstat fw -f policy

cpstat vpn -f all

cpstat blades -f fw

Hope those help as well.

Andy

Re: Checkpoint gateway Memory Usage

PhoneBoy — Sat, 11 Mar 2023 01:35:15 GMT

I see a ton of dlpu processes here.
What blades are enabled on the gateway?
Execute the command enabled_blades in expert mode.

Re: Checkpoint gateway Memory Usage

gemechisd — Sat, 11 Mar 2023 05:39:50 GMT

Below is the attached screenshot of enabled blades.