Check Point E80.72.0054 client generates very large etilqs files.

[Premysl_Vresky]

In our company, a problem occurred after the client's implementation. On the computers, we started to lose space on the HDD, we found out that c: \ windows \ temp began to contain etilqs files. They can have more than 100 GB. They overwhelm and are generated all the time. Computers are significantly slowed down. Users can not work productively

After analyzing the Process by the Monitor, we found EFRService.exe responsible for it

The problem was that RnD was evaluated as a bug, and a new client will be released in the coming days and will contain a patch. So far, this can be corrected by manual procedure. I do not write details of the procedure because I do not know if it's appropriate if we got it directly from RnD. But I hope this information can be beneficial for the CheckMate community

[PhoneBoy]

If you can send me the TAC SR in a private message, I can check with the relevant R&D owners to see if we can share the procedure.

[Premysl_Vresky]

ok

[Nir_Harhas · Accepted solution]

Please see sk122476 as a work around.

A proper fix for the issue is part of E80.80.

Thanks

Nir

[Premysl_Vresky]

Yes, with SK I have already repaired about 40 computers, now we are intensively testing 80.80. I have to install it for 1500 pc + We have one problem with us, unfortunately there was another problem when installing on 80.72.0054 has stopped working with user notifications.

Installation is automatically scheduled and will be restarted within two days without notice. This is a big problem for us because it does not allow us to move quickly to 80.80 to solve etilqs. The problem is currently being solved, I hope it will move somehow. I'm sure that even when installing on 80.80 it behaves the same way.

[Itamar_Tubul]

Hi Premysl,

Can you please elaborate in what scenario the user notifications has stopped working? 

Upgrading from which to which version?

Using Deployment? Export package? 

Itamar. 

[Premysl_Vresky]

překladač - Hledat Googlem

This occurred when moving to version E80.72.0054. It also behaves the same way when moving to E80.80.2060 Furthermore, if you add or remove a blade within E80.80.2060 (even e80.72.0054). ) This is a classic Deployment. It just does not pop up the alert window as if it were off in politics.
I tried to change the policy back and forth, propping myself on my computer, but the window does not pop out It does not plan to install two days later.  We have resolved the whole sentence since January 9  Latest support from today is: Hi Josef,   Thank you for a quick response.  Now we know for sure that something in the system is blocking the pop up, so I will open the task to our developers and they will investigate this issue.   Will keep you informed in case progress.  So maybe that will work out quickly so I can put E80.80 everywhere.

[Itamar_Tubul]

Can you send to me %localappdata%\Checkpoint\EndpointClientUI and %programdata%\CheckPoint\EndpointClientUI ?

In addition, what is the registry key value of:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\CheckPoint\Endpoint Security\LCID

[Premysl_Vresky]

files will be sent in a moment

[Premysl_Vresky]

how can I send logs? Will you give me some mail?

[Itamar_Tubul]

We are talking about a lot of MBs, You can't send it via a mail..

I'm afraid you would have to do it using our support team.

[Premysl_Vresky]

hose logos are small after compression.
One is 139 KB and the other 167 Kb.
I understand that your idea is related to the language mutation?
otherwise the ticket is assigned to Alona Strokan

(I did not want to solve the thread here but when you asked 🙂 🙂

[PhoneBoy]

I'll connect you guys privately so you can exchange private details

[Premysl_Vresky]

<div id="inner-editor"></div>

136/5000

For information:
It really was found that this is causing the Czech environment, after the change to LCID 1033 everything works (postpone). Will be corrected in 80.81