topic Re: High memory gateways in Firewall and Security Management

High memory gateways

lluner — Fri, 27 Sep 2024 18:16:04 GMT

I have a 6200 firewall cluster and I'm noticing that the firewall memory is having a high consumption and not low even with low processing

Re: High memory gateways

Lesley — Fri, 27 Sep 2024 19:01:32 GMT

Swap is low so that is good. If there are performance issues swap would increase.

Linux takes as much memory as it wants unlike Windows.

Run some basic health checks like HCP to see if there are indeed any issues.

Check monitoring if there is a memory leak (slow increase every day of memory use)

Only if there is a memory leak action is needed because this will crash the gateway at one point.

I am more worried about the CPU load, You have a load of 5 and only 4 CPU's

Re: High memory gateways

PhoneBoy — Fri, 27 Sep 2024 19:16:19 GMT

It's quite normal for the gateway to use a large percentage of memory.
What does free -m say?
The key number there is "available" (not "free" memory).

Re: High memory gateways

lluner — Fri, 27 Sep 2024 19:33:24 GMT

What does free -m say?

I want to understand if this is normal, over time the use of memory increases. When it arrives at the swap, I believe there is a problem?

I talked about the issue of memory increase because it started to affect the TE blade

Re: High memory gateways

Lesley — Fri, 27 Sep 2024 20:01:15 GMT

Looks like small memory leak, share cpinfo -y all output from relevant gw

Re: High memory gateways

PhoneBoy — Fri, 27 Sep 2024 20:18:39 GMT

High usage is normal.
Increasing over time without a commensurate increase in traffic volume? Not so much.
In any case, you might have some sort of memory leak and suggest using the following procedure to isolate it:
https://support.checkpoint.com/results/sk/sk35496
Then, of course, involve TAC.

Re: High memory gateways

Chris_Atkinson — Sat, 28 Sep 2024 02:47:31 GMT

Note the 6200 platform can have up to 32G RAM populated to support the combination of enabled blades & connection volume.

Some features such as web extraction (sk145773) leverage a RAM disk which increases base memory requirements.

Something to consider further to addressing potential memory leaks depending on your current version/JHF level.