topic Re: CPU goes 100% - Process temain ted in Firewall and Security Management

CPU goes 100% - Process temain ted

sebasnqn — Tue, 01 Oct 2024 11:38:28 GMT

Hello mates! How are you all?

We're having issues in our FW; perhaps one of you had this problem before.

FW is an open server, Version 81.10 with JHF T130; it has hyperthreading enabled and is running as proxy.

Every working day seen past few weeks, the CPU goes to 100% for several minutes. We checked the process and the temain ted seems to be taking all the stars.

There are a few elephant connections but can't be accelerated because of FW been used as proxy I think.

I've checked the affinity for temain, and seems to be attached to all the CPU available.

But, if I do "tecli show affinity" the result is

Command: root->show->affinity
error: unable to retrieve process affinity

If I check the management to see logs of the IPS blade, there is nothing there, probably because FW its suffering on 100% load.

I've no idea where else to look or what to do here; help would be really appreciate.

Thanks in advanced!

Re: CPU goes 100% - Process temain ted

the_rock — Tue, 01 Oct 2024 12:09:56 GMT

Does cprestart or reboot help?

Andy

Re: CPU goes 100% - Process temain ted

sebasnqn — Tue, 01 Oct 2024 12:14:01 GMT

Hello Andy,

Thanks for replying.

We did not restart the FW; I could try it tomorrow. After those 20 to 40 minutes of 100% load, goes like "normally".

Re: CPU goes 100% - Process temain ted

the_rock — Tue, 01 Oct 2024 12:16:11 GMT

I know one client who had this problem and went away after they upgraded to R81.20. I cant recall now what jumbo they installed, but this was few months back, probably April or May.

Andy

Re: CPU goes 100% - Process temain ted

sebasnqn — Tue, 01 Oct 2024 12:22:49 GMT

Ok, it's an option!

We've thought that and it's scheduled to do this weekend; we'll see if it helps!

Thanks!

Re: CPU goes 100% - Process temain ted

the_rock — Tue, 01 Oct 2024 12:23:47 GMT

Im fairly positive it WILL help!

Andy

Re: CPU goes 100% - Process temain ted

AkosBakos — Tue, 01 Oct 2024 12:40:03 GMT

Hi @sebasnqn

If we talk about "Elephant Flows" consider to user SecureXL Fast Accelerator"

https://support.checkpoint.com/results/sk/sk156672

It would help a lot.

Akos

Re: CPU goes 100% - Process temain ted

sebasnqn — Tue, 01 Oct 2024 13:01:52 GMT

Hi Sir,

Thanks for replying.

We've a few rules activated, but no hits on them. I think related to the proxy usage of the firewall.

Thanks though!

Re: CPU goes 100% - Process temain ted

the_rock — Tue, 01 Oct 2024 13:03:24 GMT

That also makes sense to me.

Andy

Re: CPU goes 100% - Process temain ted

PhoneBoy — Tue, 01 Oct 2024 15:18:14 GMT

ted is "Threat Emulation" not IPS.

Traffic cannot be accelerated with SecureXL when the gateway used as an explicit proxy.

Re: CPU goes 100% - Process temain ted

sebasnqn — Wed, 09 Oct 2024 11:25:36 GMT

Hello Andy,

We've upgraded to 81.20 last JHF but the problem still there. Also discover a new ones but that another thread.

I've also checked the hits on urlf with this command fw tab -t urlf_cache_tbl -s and we'e 7335 on #vals conlumns.