topic Re: Checkpoint CP 790 fwtmp almost full in Spark Firewall (SMB)

Checkpoint CP 790 fwtmp almost full

mischelw — Fri, 18 Dec 2020 19:56:01 GMT

I can see the fwtmp folder is almost full (97%) and never gets cleared. i'm afraid it will go to 100% and i will be down.

How can this folder be cleaned ? i can see also that the CPU is very high, though not much of traffic at that time.

Appreciate any help.

Willy.

Re: Checkpoint CP 790 fwtmp almost full

PhoneBoy — Sun, 20 Dec 2020 07:38:16 GMT

Are you experiencing any actual issues as a result of this?

Re: Checkpoint CP 790 fwtmp almost full

mischelw — Sun, 20 Dec 2020 07:43:03 GMT

I can see high cpu than normal.

I have cleaned the directory following the instructions sent by CP support and now I cannot load my tule base anymore, getting an error that the device cannot load the rules...

Re: Checkpoint CP 790 fwtmp almost full

PhoneBoy — Sun, 20 Dec 2020 07:45:37 GMT

What precise errors?

Re: Checkpoint CP 790 fwtmp almost full

mischelw — Sun, 20 Dec 2020 08:00:29 GMT

I'm so afraid to restart the device, as i must stay online, if the device dies on me (which seems this is what is happening...) would be very problematic 🙂

any ideas ?

Re: Checkpoint CP 790 fwtmp almost full

Amir_Ayalon — Sun, 20 Dec 2020 09:06:41 GMT

in some cases, there is a bug in fwtmp which can cause it.

it is solved in 990173072

5 December 2020: Build 990173072 is the latest R77.20.87

Thanks

Re: Checkpoint CP 790 fwtmp almost full

G_W_Albrecht — Sun, 20 Dec 2020 10:07:24 GMT

I know at least 6 old SKs about fwtemp issues that mostly were resolved in the next firmware version. Will a sk be available about this bug ? Most customers have to install new builds manually - as the WebGUI does not show the new version and sk153433 gives no details what had been fixed in 990173072, it could easily get an overlooked build...

Re: Checkpoint CP 790 fwtmp almost full

mischelw — Sun, 20 Dec 2020 10:21:53 GMT

Well, another restart (2 times) , through the webui, seems to solved the error message and cleaned up the fwtemp folder , now at 60% usage. i'll keep monitoring this, as i tend not to install updates if they are not appearing on the firewall or are not truly necessary. cannot afford downtimes...

Why they are not formally published ?

Re: Checkpoint CP 790 fwtmp almost full

PhoneBoy — Mon, 21 Dec 2020 03:09:35 GMT

We are only releasing JHF builds for the 7xx/14xx appliances against R77.20.87.
Public JHF releases are published in sk153433 but not released in the WebUI updates, to my knowledge.

Re: Checkpoint CP 790 fwtmp almost full

Amir_Ayalon — Mon, 21 Dec 2020 07:23:23 GMT

let me try to give some more details

APPI package which is downloaded from the cloud (~3MB) is kept in /fwtmp and may be replaced upon an new APPI update.
The issue was that when the file is being replaced with the new version, in some cases, some processes still kept the original (deleted) file open. This prevented the original file from actually being released, and those ~3MB were still considered as used in the /fwtmp partition.
This decreased the available space in /fwtmp.

this issue require certain scenario to happen, so it's not common, but in any case, issue was fixed on 990173072

990173072 is available in the vSMP for domains that require an upgrade.

Thanks

Re: Checkpoint CP 790 fwtmp almost full

mischelw — Mon, 21 Dec 2020 07:28:12 GMT

Thank you.

I will try to upgrade as soon as I can take the site offline for that period hoping that it will not reoccurred...