https://community.checkpoint.com/t5/Firewall-and-Security-Management/What-uses-the-memory-in-firewalls-Issue-with-memory/m-p/100712#M7852 <P>It is normal to see high memory utilization on a firewall that has been running for a long time, as spare memory is used for buffering and caching of disk operations which tend to build up over time.&nbsp; Memory used for buffering/caching can be freed at any time if the kernel needs it.&nbsp; Run <STRONG>free -m</STRONG> to see how much memory is used for code execution vs. buffering &amp; caching.&nbsp;&nbsp;</P> <P>If there is truly high memory utilization that cannot be attributed to buffering/caching, running <STRONG>top</STRONG> and hitting M will show the processes consuming the most memory in process/user space.&nbsp; You can identify the different processes and their responsibilities here:&nbsp;<A class="cp_link sc_ellipsis" href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk97638&amp;partition=Basic&amp;product=All" target="_blank">sk97638: Check Point <STRONG>Processes</STRONG> <STRONG>and</STRONG> <STRONG>Daemons</STRONG></A></P> <P>If memory utilization is high and it cannot be attributed to processes or buffering/caching, that means the kernel is consuming a large amount of memory.&nbsp; Because kernel memory cannot be swapped to disk and must reside in RAM at all times, a side effect of high kernel memory utilization will be the use of swap space by processes as there is not enough RAM for them (<STRONG>free -m</STRONG> to see this).&nbsp;</P> <P>To see if the kernel is running short on memory run <STRONG>fw ctl pstat</STRONG> and look for "failures".&nbsp; It is possible to get some insight into memory consumption inside the kernel on a per-blade basis, see the following screens in <STRONG>cpview</STRONG>:</P> <UL> <LI>Advanced.Memory.Overview</LI> <LI>Advanced.Memory.Contexts</LI> </UL> Sat, 31 Oct 2020 13:40:35 GMT Timothy_Hall 2020-10-31T13:40:35Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/What-uses-the-memory-in-firewalls-Issue-with-memory/m-p/100710#M7851 <P>Hi all</P><P>i had an issue with the memory near 100% full on my 15400 firewall this week, a reboot solved it.</P><P>my question is, what uses most the memory in firewalls? There is around 4 gig used normally, in this case 7 gig was used and the firewall was dropping connections.</P><P>do the more blades you run consume more memory? Can you tell from cpview which blade is consuming it?</P><P>cheers</P> Sat, 31 Oct 2020 12:29:41 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/What-uses-the-memory-in-firewalls-Issue-with-memory/m-p/100710#M7851 carl_t 2020-10-31T12:29:41Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/What-uses-the-memory-in-firewalls-Issue-with-memory/m-p/100712#M7852 <P>It is normal to see high memory utilization on a firewall that has been running for a long time, as spare memory is used for buffering and caching of disk operations which tend to build up over time.&nbsp; Memory used for buffering/caching can be freed at any time if the kernel needs it.&nbsp; Run <STRONG>free -m</STRONG> to see how much memory is used for code execution vs. buffering &amp; caching.&nbsp;&nbsp;</P> <P>If there is truly high memory utilization that cannot be attributed to buffering/caching, running <STRONG>top</STRONG> and hitting M will show the processes consuming the most memory in process/user space.&nbsp; You can identify the different processes and their responsibilities here:&nbsp;<A class="cp_link sc_ellipsis" href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk97638&amp;partition=Basic&amp;product=All" target="_blank">sk97638: Check Point <STRONG>Processes</STRONG> <STRONG>and</STRONG> <STRONG>Daemons</STRONG></A></P> <P>If memory utilization is high and it cannot be attributed to processes or buffering/caching, that means the kernel is consuming a large amount of memory.&nbsp; Because kernel memory cannot be swapped to disk and must reside in RAM at all times, a side effect of high kernel memory utilization will be the use of swap space by processes as there is not enough RAM for them (<STRONG>free -m</STRONG> to see this).&nbsp;</P> <P>To see if the kernel is running short on memory run <STRONG>fw ctl pstat</STRONG> and look for "failures".&nbsp; It is possible to get some insight into memory consumption inside the kernel on a per-blade basis, see the following screens in <STRONG>cpview</STRONG>:</P> <UL> <LI>Advanced.Memory.Overview</LI> <LI>Advanced.Memory.Contexts</LI> </UL> Sat, 31 Oct 2020 13:40:35 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/What-uses-the-memory-in-firewalls-Issue-with-memory/m-p/100712#M7852 Timothy_Hall 2020-10-31T13:40:35Z