topic Re: URL filtering blade (RAD process) causing high CPU tip in Firewall and Security Management

URL filtering blade (RAD process) causing high CPU tip

the_rock — Mon, 14 Apr 2025 18:03:10 GMT

Hey guys,

Just a quick tip, though Im sure most of you may know, referring to below post:

https://community.checkpoint.com/t5/Security-Gateways/High-CPU-on-Security-Gateway-caused-by-RAD-service-Slow-Internet/m-p/230702

Customer tried value of 50000 in guidbeedit, no change, so once we did failover, all worked fine. I asked them to install jumbo 99 on the cluster (currently on jumbo 98).

mgmt -> R81.20 jumbo 99

gw cluster -> R81.20 jumbo 98

Btw, if its standalone or just a single gateway, usually cprestart would work, or reboot, but just keep in mind that since cpstop unloads the policy, there would be disruption for short time.

Something to keep in mind if you ever encounter RAD process causing high CPU.

Cheers,

Andy

Re: URL filtering blade (RAD process) causing high CPU tip

D_W — Tue, 15 Apr 2025 12:27:57 GMT

We had similar issues with RAD High CPU on some systems but solution was to disable the RAD "autodebug" feature.
sk182859

Re: URL filtering blade (RAD process) causing high CPU tip

the_rock — Tue, 15 Apr 2025 12:33:36 GMT

Awesome, thanks @D_W

Re: URL filtering blade (RAD process) causing high CPU tip

the_rock — Tue, 15 Apr 2025 14:06:08 GMT

Hey @D_W

I read that sk again and shows product as anti-bot, did you apply it in the past for URLF issue and worked okay?

Andy

Re: URL filtering blade (RAD process) causing high CPU tip

Timothy_Hall — Tue, 15 Apr 2025 14:06:53 GMT

Great tip, the RAD is discussed extensively in my Gateway Performance Optimization course. The RAD was enhanced and also multi-threaded during version R80.40 which solved a lot of the old problems, but the amount of chatter between the gateway inspection code and the ThreatCloud just keeps on relentlessly increasing, and the RAD still gets in trouble occasionally. Here is the most up-to-date content from my course:

Re: URL filtering blade (RAD process) causing high CPU tip

D_W — Tue, 15 Apr 2025 14:12:29 GMT

Yes I was searching for an URLF Issue - new rule did not hit - then I saw the CPU is high and a lot of these messages in the Log

Re: URL filtering blade (RAD process) causing high CPU tip

the_rock — Tue, 15 Apr 2025 14:13:35 GMT

I was waiting for a response from a TRUE LEGEND, aka @Timothy_Hall : - )

Thank you!

Andy

Re: URL filtering blade (RAD process) causing high CPU tip

the_rock — Tue, 15 Apr 2025 14:14:54 GMT

Ah, got it. I dont believe my customer had those logs, they just noticed cpu when running top was showing 180% on rad process.

Andy

Re: URL filtering blade (RAD process) causing high CPU tip

Timothy_Hall — Tue, 15 Apr 2025 14:27:11 GMT

Right, CPU over 100% on RAD is not necessarily a problem as it is multi-threaded. However high RAD CPU accompanied with laggy Internet surfing performance may be related.

Re: URL filtering blade (RAD process) causing high CPU tip

the_rock — Tue, 15 Apr 2025 14:28:30 GMT

Yep, thats exactly issue they had, laggy surfing.

Andy

Re: URL filtering blade (RAD process) causing high CPU tip

Henrik_J — Tue, 15 Apr 2025 14:52:37 GMT

With the new generation of Quantum Gateways which are running SecureXL in User Space, we've also seen a lot of CPU and stability issues.

UPPAK has created issues with Hyperflow where Dynamic Balancing stops working due to interface state mismatch when trying to reallocate back cores.

Also some known crashes with UPPAK.

So if you're running new quantum GWs, I'd be on lookout for performance issues and bugs.

Re: URL filtering blade (RAD process) causing high CPU tip

the_rock — Tue, 15 Apr 2025 14:54:37 GMT

Thanks for that @Henrik_J

Andy

Re: URL filtering blade (RAD process) causing high CPU tip

_Val_ — Wed, 16 Apr 2025 08:13:37 GMT

Did you see sk110501 yet?

Re: URL filtering blade (RAD process) causing high CPU tip

Jan_Kleinhans — Wed, 16 Apr 2025 13:39:51 GMT

We have also such issues with 19200 and UPPAK. Also Hyperflow causes issues in KPPAK on one of our clusters. We disabled it for the moment as we want to go to UPPAK again, as we want to use the hardware acceleration of the nvidia network cards.

Re: URL filtering blade (RAD process) causing high CPU tip

the_rock — Wed, 16 Apr 2025 13:43:08 GMT

Thanks for the feedback guys, appreciated.

Andy

Re: URL filtering blade (RAD process) causing high CPU tip

Henrik_J — Wed, 16 Apr 2025 13:55:40 GMT

Interesting.

We have yet to see an hyperflow issue on our 9300.
But we'll be on lookout.

I assume disabling it requires a restart with no issues to ClusterXL Sync?

Re: URL filtering blade (RAD process) causing high CPU tip

Jan_Kleinhans — Wed, 16 Apr 2025 14:06:34 GMT

We had issues with long lasting TCP sessions like RDP, Citrix HDX or MSSQL. We had entries like this:

[11 Mar 9:06:03][fw4_11];[vs_5];psl_send_data: send_cookie_f failed [11 Mar 9:06:03][fw4_11];[vs_5];psl_send_flags: could not send cookie [11 Mar 9:06:03][fw4_19];[vs_5];cphwd_send_cookie: cphwd_send_packet failed [11 Mar 9:06:03][fw4_19];[vs_5];fwpslglue_send: cphwd_send_cookie failed [11 Mar 9:06:03][fw4_19];[vs_5];psl_glue_send_cookie: error, fwpslglue_send failed to send cookie, conn=<dir 1, 172.18.64.73:62975 -> 172.16.80.107:3389 IPP 6> [11 Mar 9:06:03][fw4_19];[vs_5];psl_send_data: send_cookie_f failed [11 Mar 9:06:03][fw4_19];[vs_5];psl_send_flags: could not send cookie

We disabled it via

connection_pipelining advanced prevent

This doesn't need a reboot and does not harm ClusterXL.

Regards,

Jan

Re: URL filtering blade (RAD process) causing high CPU tip

the_rock — Thu, 17 Apr 2025 18:56:01 GMT

Very good to know!

Andy

Re: URL filtering blade (RAD process) causing high CPU tip

GigaYang — Sun, 20 Apr 2025 20:50:35 GMT

We have also seen high CPU load caused by RAD Daemon in recent days, and it is confirmed to be related to Anti-Bot.

We found a large number of abnormal records in SmartLog (such as attachments), but we are currently unclear about the source of these connections. Any suggested analysis methods?

Thanks

Re: URL filtering blade (RAD process) causing high CPU tip

the_rock — Sun, 20 Apr 2025 21:11:36 GMT

I actually observed the same in R82 lab as well after enabling AB blade...mind you, had not seen it since installing jumbo 14, so thats a good sign.

Andy