topic Re: Strange processes in R80.10 GW in General Topics

Strange processes in R80.10 GW

Dilian_Chernev — Wed, 09 Aug 2017 07:15:47 GMT

Hi,

I saw these processes eating my CPU, but didn't have idea what they are doing on the GW:

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
5215 admin 25 0 660 180 144 R 94 0.0 20198:16 /bin/cat /dev/urandom
5216 admin 18 0 1592 432 360 S 4 0.0 778:04.27 /usr/bin/tr -dc a-zA-Z0-9
5217 admin 18 0 1580 432 360 S 3 0.0 414:26.27 /usr/bin/fold -w 32

It seems they are working since from the installation.

I made clean install of R80.10 GW 9 days ago and patched to Take 15.

Do you have any idea what these processes are doing?

Thanks

Re: Strange processes in R80.10 GW

Timothy_Hall — Wed, 09 Aug 2017 12:27:49 GMT

Need to see the Parent Process ID (PPID) of those strange processes to help figure out what they are, easiest way is to post output of command "pstree".

Or you can run "ps -ef", the first number shown is Process ID, second number shown is Parent Process ID (PPID). Once you have PPID of the mysterious process try "ps -ef | grep PPID", then look at the parent process ID of that process, rinse, repeat...

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

Re: Strange processes in R80.10 GW

Andrejs__Андрей — Wed, 09 Aug 2017 13:02:40 GMT

or use other keys for ps command:

ps axwf -o pid,comm

ak.

Re: Strange processes in R80.10 GW

Dilian_Chernev — Fri, 21 Jun 2019 08:56:24 GMT

Thanks Tim, Andrej

Here is the pstree

It seems that scrubd is responsible for these processes, and scrubd is related to Threat Extraction blade.

There is sk118353 which describes how to deal with this issue and solves my problem.

Thanks to Bogdan Tatomir for sharing resolution in this thread : https://community.checkpoint.com/thread/5144-r8010-threat-extraction-high-cpu-usage

BR,

Dilian

Re: Strange processes in R80.10 GW

Andrejs__Андрей — Thu, 10 Aug 2017 11:01:53 GMT

Thank You, Dilian!

excellent work!

ak.