topic Failed to Load Security Policy: Cannot allocate memory in Chinese 中文

Failed to Load Security Policy: Cannot allocate memory

George_Liu — Thu, 19 Apr 2018 12:58:30 GMT

Affected version: R71 SPLAT

Sympton:

1. install policy, Failed to Load Security Policy: Cannot allocate memory.

2. Gateway disk space not full.

Check procedure:

1. manual fetch policy from gateway, got same error message

(fw fetch SmartCenterIP)

2. check cpd.elg, memory allocate fail.

($CPDIR/log/cpd.elg)

3. check kernel tab, found string_dictionary_table full

(output from fw tab -s)

Workaround:

1. Disable log rulebase uuid.

(Policy -> Global Properties -> SmartDashboard Customization -> Configure -> Firewall -> General
Uncheck rulebase_uids_in_log ; click ok; then push policy.)

Re: Failed to Load Security Policy: Cannot allocate memory

Neville_Kuo — Thu, 19 Apr 2018 13:11:40 GMT

這個好多版本都有發生,情況會都一樣嗎?

Re: Failed to Load Security Policy: Cannot allocate memory

Danny_Yang — Thu, 19 Apr 2018 16:19:00 GMT

George可曾看過support center中有相關的kb參考嗎？

Re: Failed to Load Security Policy: Cannot allocate memory

George_Liu — Fri, 20 Apr 2018 04:16:58 GMT

這個問題會發生在很多版本上，正確的說，這個訊息只是一個 normal message，而發生的原因，就要逐一拆解才有機會知道是什麼狀況了。

ps. normal message 的意思是如同 debug vpn 時，常常會看到 invalid sa 的訊息一樣，但實際並不會一定 sa 有誤造成的。

Re: Failed to Load Security Policy: Cannot allocate memory

George_Liu — Fri, 20 Apr 2018 04:20:25 GMT

可以參考 Policy installation fails with "Load on module failed - no memory" error

Solution ID

sk101875

之前幾次的經驗是：

Gateway 硬碟空間不足
Policy Rule name 欄位用到中文字。(comment可以是中文，section title也可以是中文，就是 Rule name 不行)
此次的 log uuid 問題。(fw tab 中要增加 string dictionary 來做 log uuid 的對應)
不可考原因。(reboot 就解了)

Re: Failed to Load Security Policy: Cannot allocate memory

Dawei_Ye — Sun, 22 Apr 2018 07:18:10 GMT

但是，Disable log rulebase uuid之后，好像rulebase中的hit count的就不能用了？

之前我们也是碰到中文字的问题，显示这个message。

Re: Failed to Load Security Policy: Cannot allocate memory

George_Liu — Mon, 23 Apr 2018 02:11:33 GMT

感謝 Dawei Ye 兄的回報，確實，我剛上系統看了一下，disable uid 後的 install policy 確實造成 hit count 無法更新了，我來研究一下二全齊美的方法。

Re: Failed to Load Security Policy: Cannot allocate memory

George_Liu — Mon, 23 Apr 2018 02:34:33 GMT

剛在找 rulebase_uid_in_log 與 string_dictionary_table 時，看到 (sk101875) 有寫到：

This error can also be corrected by:

Updating the SmartDefense / IPS signatures.
Removing the non-ASCII character(s) such as "à" or "Ö" from the rule name and re-installing the security policy (refer to sk105708 - How to check Check Point objects and rules for non-ASCII characters).

Make sure to remove the long hyphen character ' ? ' as well from rule names and/or comments , which is created automatically by Microsoft Word.
To verify whether the problem is caused by the non-ASCII (international) character, follow these steps:
1. On a Security Gateway, run: fw ctl zdebug filter > /var/log/debug.txt.
2. Install the security policy in SmartDashboard.
3. Analyze the /var/log/debug.txt file.
If this error is indeed caused by the non-ASCII (international) character, the the following message will appear in the output file:
fw_rules_uid_handle_uid: couldn't allocate dictionary string id for rule no. <N>

Re: Failed to Load Security Policy: Cannot allocate memory

Neville_Kuo — Mon, 23 Apr 2018 06:41:49 GMT

今天用以下這篇治好公司80.10的hit count問題:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk79240&partition=Advanced&product=Security

心得:

1.uid不能亡

2.Clear console cache

3.到80.10還是會,超靠悲

Re: Failed to Load Security Policy: Cannot allocate memory

Danny_Yang — Wed, 25 Apr 2018 17:58:31 GMT

你才靠悲，你全家都靠悲

Re: Failed to Load Security Policy: Cannot allocate memory

George_Liu — Sun, 19 Mar 2023 08:17:40 GMT

Thanks 5 years ago George, this sharing help me a lot. Here is some reference.

What is the string_dictionary_table? sk61541

How to change the string_dictionary_table size. sk66342

Installation failed on one of Active gateway: Failed - Installation failed. Reason: Load on Module failed - failed to load Security Policy.