topic Re: Issue with high memory usage on 2200 Firewall - R80.20 build 163 in Firewall and Security Management

Issue with high memory usage on 2200 Firewall - R80.20 build 163

carl_t — Tue, 28 Jan 2020 11:56:49 GMT

Hi All

We seem to have an issue with our 2200 Gateway, we are seeing memory regularly reach 100%

Some details below

free -mt
total used free shared buffers cached
Mem: 1868 1854 13 0 2 283
-/+ buffers/cache: 1568 299
Swap: 4094 674 3420
Total: 5962 2529 3433

enabled_blades
fw vpn ips mon vpn

top

top - 11:55:35 up 17:56, 1 user, load average: 0.11, 0.24, 0.21
Tasks: 99 total, 3 running, 96 sleeping, 0 stopped, 0 zombie
Cpu(s): 2.0%us, 2.3%sy, 0.0%ni, 95.3%id, 0.0%wa, 0.0%hi, 0.3%si, 0.0%st
Mem: 1912916k total, 1901756k used, 11160k free, 2652k buffers
Swap: 4192956k total, 690860k used, 3502096k free, 293000k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
4932 admin 15 0 30312 8428 3548 S 3 0.4 1:58.36 cpview_historyd
4929 admin 22 0 188m 5916 4536 S 1 0.3 0:42.88 cpviewd
10039 admin 15 0 2116 1080 828 R 1 0.1 0:00.06 top
3747 admin 15 0 0 0 0 R 0 0.0 7:49.48 fw_worker_1
1 admin 15 0 1980 516 496 S 0 0.0 0:00.86 init
2 admin RT -5 0 0 0 S 0 0.0 0:01.30 migration/0
3 admin 15 0 0 0 0 S 0 0.0 0:00.00 ksoftirqd/0
4 admin RT -5 0 0 0 S 0 0.0 0:00.00 watchdog/0
5 admin RT -5 0 0 0 S 0 0.0 0:01.07 migration/1
6 admin 15 0 0 0 0 S 0 0.0 0:00.00 ksoftirqd/1
7 admin RT -5 0 0 0 S 0 0.0 0:00.00 watchdog/1
8 admin 10 -5 0 0 0 S 0 0.0 0:01.09 events/0
9 admin 10 -5 0 0 0 S 0 0.0 0:00.50 events/1
10 admin 10 -5 0 0 0 S 0 0.0 0:00.01 khelper
27 admin 11 -5 0 0 0 S 0 0.0 0:00.01 kthread
28 admin RT -5 0 0 0 S 0 0.0 0:00.00 kmem_kthread
33 admin 10 -5 0 0 0 S 0 0.0 0:00.25 kblockd/0
34 admin 10 -5 0 0 0 S 0 0.0 0:00.03 kblockd/1
35 admin 15 -5 0 0 0 S 0 0.0 0:00.00 kacpid

Any ideas why this is and what we can do to fix?

Cheers

Re: Issue with high memory usage on 2200 Firewall - R80.20 build 163

Maarten_Sjouw — Tue, 28 Jan 2020 12:07:42 GMT

I see you are using a 2GB 2200 (A version) with R80.20 which I doubt is supported, the least you need, as far as I know, to be able to run R80.x is 4GB (the B model).
Running it without any blades enabled will probably already be enough to fill the memory.

Re: Issue with high memory usage on 2200 Firewall - R80.20 build 163

G_W_Albrecht — Tue, 28 Jan 2020 12:09:37 GMT

That is an easy one - if you read the R80.20 Release Notes, you see that the minimal hardware requirements are 4 GB RAM. So you can:

- add more memory

- disable TP Blades

- trade in for new hardware

Re: Issue with high memory usage on 2200 Firewall - R80.20 build 163

G_W_Albrecht — Tue, 28 Jan 2020 12:10:13 GMT

You have been 2min earlier 😉 !

Re: Issue with high memory usage on 2200 Firewall - R80.20 build 163

Daniel_Hainich — Tue, 28 Jan 2020 15:27:39 GMT

i mean the intel atom has an memory-limit of 2gb ram. so upgrading should not be possible.

edit: the intel atom D525 has an memory limit of 4GB Ram. So you can upgrade.

Re: Issue with high memory usage on 2200 Firewall - R80.20 build 163

carl_t — Tue, 28 Jan 2020 15:23:56 GMT

It says they do a memory upgrade kit so surely it must be possible ?

Re: Issue with high memory usage on 2200 Firewall - R80.20 build 163

Jerry — Tue, 28 Jan 2020 15:25:33 GMT

you can buy RAM modules yourself but bear in mind this will void warranty if still applicable 🙂
it isn't difficult to upgrade these boxes, but CPU may not handle R80.xx indeed ... all depends on your spec.

Re: Issue with high memory usage on 2200 Firewall - R80.20 build 163

Timothy_Hall — Thu, 30 Jan 2020 19:14:44 GMT

Agree with @Jerry here, even if you upgrade RAM to 4GB your next critical bottleneck will most definitely by the CPU. I don't think you will gain much of an overall performance improvement with a RAM upgrade on the 2200 in this case, even a 3200 model would be much better...

Re: Issue with high memory usage on 2200 Firewall - R80.20 build 163

PhoneBoy — Thu, 30 Jan 2020 23:19:26 GMT

The 2200 with either 2GB or 4GB of RAM is pretty close to End of Life.
Highly recommend trading this in for a newer appliance that has more RAM and a stronger CPU.
Your local Check Point reseller/office can assist with this.