topic Re: file_analyzeefr.db growing uncontrollably (25GB+) in Check Point Endpoint – anyone seen this bef in Endpoint

file_analyzeefr.db growing uncontrollably (25GB+) in Check Point Endpoint – anyone seen this before?

jorgeluiznim — Thu, 23 Apr 2026 21:46:53 GMT

Hello,

I’m currently facing an issue on a Windows server running Check Point / Harmony Endpoint and wanted to check if anyone has experienced something similar and managed to resolve it.

The file below is growing continuously and uncontrollably:

C:\ProgramData\CheckPoint\DBStore\backup\file_analyzeefr.db

At the moment, it has already exceeded 25GB and keeps increasing without stopping, quickly consuming the available disk space on the server.

This is causing the disk to approach full capacity in a very short time.

What I’ve observed so far:

The growth does not stop even after restarting the endpoint service

The file resumes growing rapidly after any mitigation attempts

It appears to be related to the Check Point agent continuously writing to the DBStore

I have already tried restarting the endpoint service and monitoring disk usage, but the behavior persists.

Has anyone encountered this issue with this file or the Check Point DBStore before?

If so, were you able to identify the root cause? Could it be a version bug, log/event loop, synchronization issue, or a specific configuration problem?

Any guidance on how to resolve or mitigate this would be greatly appreciated.

Thank you.

Re: file_analyzeefr.db growing uncontrollably (25GB+) in Check Point Endpoint – anyone seen this bef

lluner — Fri, 24 Apr 2026 12:20:39 GMT

@jorgeluiznim

Which version are you using?

Screenshot of the file on my machine; what could be happening that the log file rotation isn't occurring? My version client : E89.10 ( 89.10.0.370 )

Re: file_analyzeefr.db growing uncontrollably (25GB+) in Check Point Endpoint – anyone seen this bef

the_rock — Sat, 25 Apr 2026 16:11:10 GMT

Might be worth TAC case.

Re: file_analyzeefr.db growing uncontrollably (25GB+) in Check Point Endpoint – anyone seen this bef

tankp — Sat, 09 May 2026 05:44:49 GMT

It is created by EFRService.exe. Reboot to safe mode and delete it. It will be recreated after EFRService.exe starts again. According to similar cases, it should be fixed on the E89.05 version.