snmpd restarting every 2 hours

[boyuum]

Hello

I have an issue with one of my HA device (R80.40) which keep restarting snmpd every 2 hours, i know it by looking at my network monitor like cacti and then check /var/log/message which shows /usr/sbin/snmpd restart every 2 hours

And coincidentally at the same time, there is an error with the ips 

I attached /var/log/message full capture and grepped snmpd

TIA

[_Val_]

It looks like the SNMP daemon crashes regularly, leaving a core dump. Unfortunately, you are running an old version that is out of support now.

Did you consider upgrading it to one of the supported versions yet?

[boyuum]

Yes, along with renewing the box on this year. 

[Chris_Atkinson]

Further to what @_Val_ has suggested, it would be helpful to at least understand which Jumbo (JHF) take is used with the system but ultimately you should consider upgrading.

[Lesley]

Yes Jumbo is important detail. CTRL + F and search SNMP here on this page: https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/R80.40/R80.40-List-of-all-Resolved-Issues.htm?...

You will see many open bugs / issues solved regarding SNMP. Before you do major upgrade to R81.20 you could consider to bring R80.40 to the latest Jumbo take 221

Final, run a hcp -r all on relevant gateway. There you can spot issues, I would expect coredumps for SNMP and maybe more (IPS issue). 

[boyuum]

I run hcp -r all command and as you said, there are coredumps for snmpd. As for ips issue, there is no issue can be found

[G_W_Albrecht]

Interesting issue, but what is the problem with it ? Although restarting every 2h is not good behaviour. this happens only to the monitor daemon and does not cause any network issues (?). As this version is out of any support since one year, posting this here will only provoke suggestions to upgrade to a supported version 😉

[boyuum]

Technically it does not cause any real network issue like you said, but the user dont like to see any yellow warning icon at the dashboard 😅, and they will have an audit/inspection soon too

[the_rock]

I get that totally, Im the same way :). Btw, maybe open old school sv monitor from c/program files x86/checkpoint/smartconsole/R81.xx folder and see if it gives more info about it.

Andy

[G_W_Albrecht]

You are kidding, are you ? Audit for an unsupported firewall version ? The yellow warning is the least issue here.... Or does the customer have a special deal with CP so he has support ?

[boyuum]

Im not kidding, its not just an audit for firewall but a whole security device in the department.

Its true the yellow warning is the least issue, but it will raise some questions from auditors

[Chris_Atkinson]

So which JHF is deployed ?

[boyuum]

Looks like there is no JHF deployed at the moment

[Chris_Atkinson]

I hope this isn't true but if it is then seems we most probably found the solution.

[the_rock]

I would upgrade to R81.20 if you can.

Andy