topic Re: Management dump files in Endpoint

Management dump files

Premysl_Vresky — Thu, 01 Feb 2018 10:38:47 GMT

In the C: \ Windows \ Internet Logs folder, dump Check Point files are stored.
For example:
EFRService_2nd_2018_01_31_21_08_37_small.dmp
CP_EFR_Crash_860045016_1515599330.dmp

On one computer, I found 7 GB total logs.

Since I have over 1500+ endpoint installs, I do not even know how many computers these dmp files are and how much space they occupy. I need to help with the third party tool for analysis and removal.
Idea:
Put some size limit on this folder, or direct these files to another folder and put there a similar mode as the folder c: \ sendblastbackup .. to delete old files.
Just introduce some management of these files
I have a ticket based on this issue, I write it here to help other administrators if they do not know about it.

Re: Management dump files

XavierBens — Thu, 01 Feb 2018 13:58:50 GMT

Hi, did you try to understand why such dump logs were generated ? Was there generated frequently ? During a specific period of the day/week/month ?

Do you have the same version deployed on every workstation ? If so : what version (maybe a known issue fixed in later builds) ?

For the deletion of the logs : dis you deploy the package through tools such as Altiris, SCCM, ... ? Because you should include in the package installation process the deletion of such files (and just before : generat a report in order to understand if this issue is at large or for specific computers).

Re: Management dump files

Premysl_Vresky — Thu, 01 Feb 2018 15:39:31 GMT

The principle of this idea is not to solve individual cases, these files are old, on computers we perform regular update of clients.
I'm afraid that the storage of these files is not limited. I'm just starting to analyze the situation, I find that damp files are on hundreds of computers. On laptops we usually have a 128GB SSD HDD and then there is a problem if the dump files occupy, for example, 15GB.
It's a native system solution via Check Point. I could imagine a limit of 2 GB, for example, and gradually remove old files.
I assume that these files did not occur during deployment but during normal operation.

Re: Management dump files

PhoneBoy — Fri, 02 Feb 2018 00:12:36 GMT

It seems like you should be engaging with the Check Point TAC about this.

Contact Support | Check Point Software

Re: Management dump files

Premysl_Vresky — Fri, 02 Feb 2018 06:30:11 GMT

Yes, I work together. I wrote the information here because I think it might be of interest to the CheckMate community. It has not occurred to me for several months that there is so much data on computers.

Re: Management dump files

Amanda_90 — Wed, 03 May 2023 14:39:31 GMT

Hi, Guys!

I have the same problem on an endpoint, it is taking up too much space in the ProgramData\CheckPoint\EndPoint Security\Threat Emulation\ folder

They are files with the same .DMP extension, I would like to know if I can delete them and how can I do it?

Re: Management dump files

toviab — Thu, 04 May 2023 06:20:42 GMT

Hi @Amanda_90 ,
If these files are new it can indicate a problem with the ThreatEmulation service and we would need to investigate why the service is creating these dump files.
If it is old files from older version then these can be deleted.
You can contact TAC to assist in removing these files as they are protected and you will need to remove the protection prior to deleting them.
Regarding the main issue, we will discuss this issue and see how we can address the issue by setting a limit to these files.

Re: Management dump files

geolog — Tue, 11 Mar 2025 09:49:23 GMT

Hi, did you solve your problem please? We have a very similar problem, only the location of the resulting dmp files is different (usually c:\ProgramData\CheckPoint\EndPoint Security\Threat Emulation but also others, it depends on which module crashes). It's not about an analysis, the dumps are old and there is a newer version of endpoint on the stations.
The main problem is the space they take up and the impossibility of deleting the dump while the endpoint is active, so far the only procedure I know is to uninstall the Endpoint client and then clean it completely, besides, the client leaves behind a lot of old logs and other temps..
I haven't contacted TAC yet, how did you end up?

Re: Management dump files

geolog — Tue, 11 Mar 2025 09:50:42 GMT

Hi, please did you solve your problem please? We have a very similar problem, only the location of the resulting dmp files is different (usually c:\ProgramData\CheckPoint\EndPoint Security\Threat Emulation but also others, it depends on which module crashes). I haven't contacted TAC yet, how did you end up?