topic Checkpoint R81.20 more than 4000 CPU SPIKES few days in Firewall and Security Management

Checkpoint R81.20 more than 4000 CPU SPIKES few days

tiagomarques23 — Tue, 03 Sep 2024 21:27:01 GMT

Hello,

Since August 25th, I've had 4,400 CPU spikes (number of files in the directory "/var/log/spike_detective/" on a CheckPoint 9700 cluster.

I learned that migrating from R81.20 TAKE 69 to R81.20 TAKE 76 should resolve the issue, as there was a CPU bug fixed between Takes 70-76.

My question is:
Can I delete the spike files in the "/var/log/spike_detective/" directory?
Is there any risk in doing so?

Re: Checkpoint R81.20 more than 4000 CPU SPIKES few days

PhoneBoy — Thu, 05 Sep 2024 22:14:01 GMT

I believe these are safe to remove.
Having said that, I would take a backup of those files first and possibly check with TAC to confirm.

Re: Checkpoint R81.20 more than 4000 CPU SPIKES few days

the_rock — Thu, 05 Sep 2024 22:17:01 GMT

Its 100% safe to remove them. I had TAC verify this couple of years ago when client had this issue. But, as Phoneboy said, you should take backup, just in case.

Andy

Re: Checkpoint R81.20 more than 4000 CPU SPIKES few days

Ruan_Kotze — Fri, 06 Sep 2024 07:59:58 GMT

Hi Taigo,

Can you share more info around the CPU issues fixed by T69 / T76? Is it the fix referred to in sk182223 or another one?

Reason I ask is because I am investigating an customer outage caused by CPU utilization, but until we can conclusive say it will fix the issue the customer does not want to upgrade from T65.

Thanks,
Ruan

Re: Checkpoint R81.20 more than 4000 CPU SPIKES few days

tiagomarques23 — Fri, 06 Sep 2024 09:54:28 GMT

It's not official, but what we've seen with different colleagues from other companies is that since they updated between take 70-76 they no longer have cpu spike problems.

In the following link you can see more information: https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/R81.20/R81.20-List-of-all-Resolved-Issues.htm (search CPU ... find something on take 70)