topic Re: Memory increase in FW's model SMB 1800 after updating to R81.10 in Spark Firewall (SMB)

Memory increase in FW's model SMB 1800 after updating to R81.10

Luis1980 — Tue, 25 Jul 2023 10:49:23 GMT

Hello everyone.

After upgrading to R81.10 in a backup center environment 2 FW's model SMB 1800, it has an increase in memory which is not normal for the use they have. One of them is exceeding 80%, the TAC is investigating but they do not give any clear answer. Can someone help with this issue. Thank you.

This is Check Point's 1800 Appliance R81.10.05 - Build 301

R81.10.05 (996001301)

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Lesley — Tue, 25 Jul 2023 11:02:39 GMT

We had same issue. Saw it was related to SFWD. Upgrade to version R81.10.07, looks more stable now.

See any output? : cat $FWDIR/log/sfwd.elg | grep -i '360 MB' -A 1

ps aux | grep -i sfwd

Then I know if we have the same issue.

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Luis1980 — Tue, 25 Jul 2023 11:10:38 GMT

Hello these are the results, we have the same problem?

[Expert@]1# cat $FWDIR/log/sfwd.elg | grep -i '360 MB' -A 1
sfwd_periodic_memory_rss: sfwd RSS (360 MB) is over the defined limit (360 MB). sfwd is exiting!
[sfwd 2929 4156636416]@FWI-BCP[21 Jul 19:03:27] sfwd: Fri Jul 21 19:03:27 2023
--
sfwd_periodic_memory_rss: sfwd RSS (360 MB) is over the defined limit (360 MB). sfwd is exiting!
[sfwd 19308 4156308736]@FWI-BCP[22 Jul 20:45:15] sfwd: Sat Jul 22 20:45:15 2023
--
sfwd_periodic_memory_rss: sfwd RSS (360 MB) is over the defined limit (360 MB). sfwd is exiting!
[sfwd 3169 4157357312]@FWI-BCP[23 Jul 22:27:03] sfwd: Sun Jul 23 22:27:03 2023
--
sfwd_periodic_memory_rss: sfwd RSS (360 MB) is over the defined limit (360 MB). sfwd is exiting!
[sfwd 19491 41515Expert@1]# ps aux | grep -i sfwd
root 11822 0.0 0.0 4992 4352 ? S Jun15 1:09 /bin/bash /pfrm2.0/etc/sfwd_check_state.sh
root 14052 0.0 0.0 6528 3648 pts/0 S+ 13:05 0:00 grep -i sfwd
root 19491 0.5 3.1 456128 251968 ? Ssl 00:08 4:15 fw sfwd

It has different results and is the one with the highest memory.

[Expert@2]# cat $FWDIR/log/sfwd.elg | grep -i '360 MB' -A 1
[Expert@]2# ps aux | grep -i sfwd
root 349 0.0 0.0 6592 1920 pts/1 S+ 13:06 0:00 grep -i sfwd
root 10885 0.0 0.0 4992 4416 ? S Jun15 1:09 /bin/bash /pfrm2.0/etc/sfwd_check_state.sh
root 17924 1.2 2.3 404864 187520 ? Ssl Jun15 696:21 fw sfwd
root 19574 0.0 0.0 4928 4352 ? S Jun15 1:04 /bin/bash /pfrm2.0/etc/sfwd_check_state.sh

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Lesley — Tue, 25 Jul 2023 11:16:16 GMT

I would upgrade the units and share the above output to TAC. Of course make sure you make new output after upgrade.

We still get sfwd RSS (360 MB) is over the defined limit (360 MB). sfwd is exiting! , after the upgrade. We are going to try to increase the 360MB value. I don't have any results regarding it yet.

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Luis1980 — Tue, 25 Jul 2023 11:29:53 GMT

It means that although updated to R81.10.07 has not been solved?, I have happened to my integrator to add this in the case in case they tell me that it is the same problem.

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Sbolton — Mon, 11 Dec 2023 17:11:58 GMT

Any resolution to this? We are seeing this same issue with ANY SMB that we've moved from local to central management as well.

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Amir_Ayalon — Mon, 11 Dec 2023 18:00:07 GMT

Might be false indication in the management.

We are looking into it.

You are Welcome to open an SR and asked for a Task to be assigned to R&D

Thanks

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Sbolton — Mon, 11 Dec 2023 18:06:57 GMT

I've had a ticket open for the past two months (They've transfered and closed the old ones multiple times.) I've been moving a single customer into Smart-1 Cloud and since we upgraded to R81.10.08 and went to central management, that device is crashing fairly consistently. I'm seriously wondering if this is an issue with R81.10.05 and above, not R81.10 in general.

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

the_rock — Mon, 11 Dec 2023 23:57:40 GMT

I had seen few posts about it on the forum recently. I know one customer who has software option set to auto update, so far, no issues. Mind you, theirs is locally, not centrally managed, so not sure if that would make a whole lot of difference.

Best regards,

Andy

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Chris_Atkinson — Tue, 12 Dec 2023 23:57:14 GMT

Which specific model of gateway in your case, does the issue persist with R81.10.08 Build 996001683 ?

( 30 November 2023: R81.10.08 Build 996001683 image has been released for 1500 / 1600 / 1800 appliances, replacing Build 996001608, refer sk181079. )

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Sbolton — Tue, 12 Dec 2023 15:31:36 GMT

1590 SMB, went from R80.20.50 to R81.10.08. Constant issues ever since.

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

the_rock — Tue, 12 Dec 2023 15:35:00 GMT

So whats latest from TAC? To me, seems like this is more than enough reason for RMA if no one can figure out why crashes are happening...

Andy

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Sbolton — Tue, 12 Dec 2023 15:36:07 GMT

Supposedly in R81.10.05 they added several services, some of which only work in local managed mode, not centrally managed.

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

the_rock — Tue, 12 Dec 2023 15:38:52 GMT

Logically, that would certainly explain it. Not sure if they provide custom fixes for those appliances, like they do for regular Gaia. Personally, Im not a big fan of those, as they can be an issue when trying to install next recommended jumbo take, but maybe works bit different on SMB.

Andy

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Sbolton — Tue, 12 Dec 2023 15:38:59 GMT

The first response from TAC was, "Buy a better box." To which I told them that we had 0 issues on the old firmware, and that central management is supposed to reduce memory usage, not increase it. To which they replied asking for additional logs and for a RAM intensive debug to be run on the device at hand. It's been a consistent back and forth ever since then.

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

the_rock — Tue, 12 Dec 2023 15:40:20 GMT

Buy a better box? Wow...if those were the exact words, Im truly speechless.

Andy

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Sbolton — Tue, 12 Dec 2023 15:49:23 GMT

Not exact words, it was more along the lines of. "We notice a high RAM usage from Dr. Spark. We would recommend that you purchase a firewall that can handle the traffic at this location." A little more sophisticated, but basically the same thing.

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

the_rock — Tue, 12 Dec 2023 15:51:32 GMT

But still, even that answer, to me, if you think about it logically, makes no sense at all its the hardware issue, because if all worked fine BEFORE installing new software, its obviously software problem, not hardware.

Andy

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

Sbolton — Tue, 12 Dec 2023 16:00:15 GMT

I completely agree. And that was why both I, and my sales team, didn't appreciate that response. I hope they fix their issues soon cause this is not okay.

Re: Memory increase in FW's model SMB 1800 after updating to R81.10

the_rock — Tue, 12 Dec 2023 17:15:01 GMT

Of course nothing about what you described is okay, Im with you 100%. Why not try escalate the issue further through TAC? Just a suggestion...

Andy