topic Re: cpcgroup.elg flooded in Firewall and Security Management

cpcgroup.elg flooded

Jan_Kleinhans — Tue, 25 Mar 2025 07:37:11 GMT

Hello,

is it normal that cpcgroup.elg is flooded the whole day? We get 30 new lines every second. Using R81.20 T76/96/98

cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73567
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73568
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73569
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77773
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77774
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77775
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73570
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77776
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73571
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77777
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73572
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77778
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73573
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77779
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73574
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73575
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73576
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73577
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77780
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77781
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73578
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73579
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77782
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73580
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73581
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73582
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73583
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77783
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73584

Regards,

Jan

Re: cpcgroup.elg flooded

PhoneBoy — Tue, 25 Mar 2025 14:28:13 GMT

Best to check this with TAC.

Re: cpcgroup.elg flooded

Lesley — Tue, 25 Mar 2025 19:04:00 GMT

Using R81.20 T76/96/98: you have this issue on more gateways? Or the issue remained during upgrades?

Is this VSX gateway? Does this issue impact disk space? Does it rotate the file when full? (check if there is cpcgroup.elg.1 cpcgroup.elg.2 etc in same dir as cpcgroup.elg

Re: cpcgroup.elg flooded

Jan_Kleinhans — Wed, 26 Mar 2025 08:15:57 GMT

Hello,

we have it on all VSX Gateways. It doesn't impact disk space. Rotation works. The only thing I want to know if this is normal behaviour. I find it very strange to have a file that gets flooded continoous.

I didn't want to open a case for this before knowing if this is normal behaviour.

Regards,

Jan

Re: cpcgroup.elg flooded

G_W_Albrecht — Wed, 26 Mar 2025 08:23:55 GMT

Open a SR# with CP TAC to learn if that is standard behaviour...

Re: cpcgroup.elg flooded

Lesley — Wed, 26 Mar 2025 10:07:51 GMT

Hi,

Sorry but I think this has to be a TAC case. There is very limited info regarding this out there.

I think it is filling up a database (maybe cpview) and when it does that it prints it in this file. But again due lack of documents / sk's it is only a guess

Re: cpcgroup.elg flooded

Jan_Kleinhans — Thu, 27 Mar 2025 09:05:48 GMT

Case is opened.

Re: cpcgroup.elg flooded

Julien_Tissot — Wed, 23 Apr 2025 13:29:51 GMT

Hello,

Do you have any update on this one ?

Thanks

Re: cpcgroup.elg flooded

Jan_Kleinhans — Wed, 23 Apr 2025 13:54:47 GMT

TAC posted this in our case:

Solution Description: We did check this extensive logging in cpcgroup.elg issue with our product team.

Please be informed that these messages are normal and will not impact the environment.