Check Point Linux agent's files taking too much space in root DIR

[Firewall_Head]

Hi Checkmates,

I was just going through my Linux machine and randomly found the cpla agent taking around 3G on the /root partition.

Can someone tell me what cpla-sandbox does and why the size of this directory is this high.

4.0K  ar
308M  cpam
0 cpla
2.5G cpla-sandbox
12K  cpmgmt
3.7M cpsba
16K  da
0  efr

Inside cpla-sandbox are some mystical files.

[root@centos7 cpla-sandbox]# ll | awk '{print $9}'

cpla-linux-73f5b1a9afeb
cpla-linux-73f5b1a9afeb-extract.lock
cpla-linux-8ea3a64234df
cpla-linux-8ea3a64234df-extract.lock
cpla-linux-f91e486e6c71
cpla-linux-f91e486e6c71-extract.lock
cpsysdig-08642f57cb14
cpsysdig-08642f57cb14-extract.lock
cpsysdig-760a81969561
cpsysdig-760a81969561-extract.lock
cpsysdig-ecfa2a0769d9
cpsysdig-ecfa2a0769d9-extract.lock

Thanks in advance!

=======

WR,

FH

[PhoneBoy]

Possible these are files that are just not getting cleaned up.
It seems there is a known issue that was propagated from earlier releases that an "upgrade" doesn't exactly fix (i.e. the issue carries over with an upgrade).

Suggest uninstalling the client, remove /var/log/checkpoint and /var/lib/checkpoint folders:

sudo rm -rf /var/log/checkpoint
sudo rm -rf /var/lib/checkpoint

Reinstall 1.18.16 (or above) again
Monitor the size of the /var/lib/checkpoint folder again.

The issue was found in older client versions and was found to be carried forward in upgrade scenarios, so complete removal of the client, and clean up of the files is required to clear up the issue.

If you're still having an issue, might require TAC to investigate.

[Firewall_Head]

Hi @PhoneBoy ,

I see this to be a major problem because I manage around 500 endpoints where the agent is running. When I randomly checked some of the servers, the same issue is seen on them also.

Can Check Point add a fix to this problem, It is very hard to reinstall the agent on all the systems.

I have attached the steps that I followed to fix this automatically with a newer version release.

=====

WR,

FH

[Firewall_Head]

sorry there's a typo in my last message.

Pls ignore !😶

"I have attached the steps that I followed "

====

WR

FH

[PhoneBoy]

I agree uninstalling and reinstalling the agent is not the optimal solution here.
I found this solution in a TAC case.

@JonnyRabinowitz any idea on this one?